Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
Analysis ID:1367834
MD5:aae3eedbdc1b1a99f7c2844f85352692
SHA1:8025c689f73816e6c275e38002649d91244d6db2
SHA256:2c1d65f58f07ad391492f0c0b1c335321f7b0d6e9f41218e04404e7b58692ddb
Tags:exe
Infos:

Detection

Score:51
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:17
Range:0 - 100

Signatures

Yara detected AntiVM3
Contains functionality to infect the boot sector
Creates an undocumented autostart registry key
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to record screenshots
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
DLL planting / hijacking vulnerabilities found
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Registers a DLL
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe (PID: 6116 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe MD5: AAE3EEDBDC1B1A99F7C2844F85352692)
    • regsvr32.exe (PID: 180 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 3672 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 2660 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • 360TopbarASS.exe (PID: 2884 cmdline: "C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe" MD5: DEC58427DAFCCF050DA9AC893E28407C)
    • regsvr32.exe (PID: 1004 cmdline: "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 6496 cmdline: "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 2972 cmdline: "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 5260 cmdline: /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
    • GBInst.exe (PID: 1896 cmdline: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S MD5: 32DC2FA6DB8B8809B12A8CAD215C69FD)
    • 360wpappInstaller_zhuomian.exe (PID: 6724 cmdline: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian MD5: 02C91D3BE856789E1711C37649F382CC)
    • flashApp.exe (PID: 4584 cmdline: "C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe" onlyimport MD5: 28580334E670277D005E38D4C9E65CFD)
    • 360DesktopSwitch64.exe (PID: 3688 cmdline: "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe" /unloaddtswitcher MD5: 476B86E7D05550919702E25541927DA5)
    • regsvr32.exe (PID: 5348 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 5420 cmdline: /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
    • regsvr32.exe (PID: 4840 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 3148 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
  • 360TopBar.exe (PID: 4940 cmdline: "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun MD5: B70E8845A3DFB674910975E6D0C061EC)
    • 360wpsrv.exe (PID: 4656 cmdline: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe StartByDesktop StartFrom=4 MD5: B8B17E96DFCB39621A7D886528D1FACC)
      • 360wpapp.exe (PID: 5392 cmdline: "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper MD5: F9093B9504ABF8EE62BAF4B74D665841)
      • 360wpapp.exe (PID: 1992 cmdline: "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper MD5: F9093B9504ABF8EE62BAF4B74D665841)
  • explorer.exe (PID: 4084 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
    • WerFault.exe (PID: 3608 cmdline: C:\Windows\system32\WerFault.exe -u -p 4084 -s 10344 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • explorer.exe (PID: 3748 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
    • WerFault.exe (PID: 6844 cmdline: C:\Windows\system32\WerFault.exe -u -p 3748 -s 5128 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • explorer.exe (PID: 4632 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    Process Memory Space: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe PID: 6116JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F23230 CreateFileW,LocalAlloc,LocalAlloc,LocalFree,CryptCATAdminCalcHashFromFileHandle,GetLastError,LocalFree,LocalAlloc,CloseHandle,17_2_02F23230
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F23210 CryptCATAdminReleaseContext,17_2_02F23210
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F237D0 CryptCATAdminAcquireContext,CryptCATAdminEnumCatalogFromHash,CryptCATAdminReleaseCatalogContext,LocalFree,17_2_02F237D0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F23560 lstrlenA,MultiByteToWideChar,WinVerifyTrust,WTHelperProvDataFromStateData,WTHelperGetProvSignerFromChain,WTHelperGetProvCertFromChain,CertGetNameStringA,WinVerifyTrust,lstrlenA,MultiByteToWideChar,CryptCATAdminEnumCatalogFromHash,CryptCATAdminReleaseCatalogContext,LocalFree,17_2_02F23560
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8BE990 CryptBinaryToStringA,19_2_6C8BE990
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8CA440 CryptDestroyKey,19_2_6C8CA440
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8CA460 CryptDestroyHash,19_2_6C8CA460
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8BE6C0 CryptBinaryToStringA,_memmove_s,_memcpy_s,19_2_6C8BE6C0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C90A7A4 _LocaleUpdate::_LocaleUpdate,_strlen,CryptBinaryToStringA,_strlen,19_2_6C90A7A4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8CE090 CryptGetHashParam,19_2_6C8CE090
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8CA030 CryptReleaseContext,19_2_6C8CA030
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8CA120 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,_memset,lstrcpynA,CryptImportKey,CryptCreateHash,CryptSetHashParam,CryptHashData,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,19_2_6C8CA120
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8CA320 CryptGetHashParam,CryptGetHashParam,CryptGetHashParam,19_2_6C8CA320
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C923420 CertOpenStore,CryptMsgOpenToDecode,CryptMsgUpdate,CertCloseStore,CryptMsgClose,19_2_6C923420
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8E3560 CryptUnprotectData,19_2_6C8E3560
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8E32A0 CryptProtectData,LocalFree,19_2_6C8E32A0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8BB380 CryptBinaryToStringA,CryptBinaryToStringA,CryptBinaryToStringA,19_2_6C8BB380
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C9413E0 CryptDestroyKey,19_2_6C9413E0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8E3360 CryptUnprotectData,19_2_6C8E3360
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: LINKINFO.dllJump to behavior
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: MSIMG32.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: WINMM.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: Secur32.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: SSPICLI.DLL
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: profapi.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: MSASN1.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\safelive.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: srvcli.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: VERSION.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: cscapi.dllJump to behavior
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: dbgcore.DLL
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: WININET.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: NETAPI32.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: Cabinet.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\PDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360verify.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\360verify.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: DEVRTL.dllJump to behavior
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: netutils.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360P2SP.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: IPHLPAPI.DLL
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: edputil.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: iertutil.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\7z.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: urlmon.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360net.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: WindowsCodecs.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: dbghelp.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: Wldp.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: TextShaping.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Uninstall.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeEXE: regsvr32.exeJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exe

      Compliance

      barindex
      DLL planting / hijacking vulnerabilities found
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: LINKINFO.dllJump to behavior
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: MSIMG32.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: WINMM.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: Secur32.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: SSPICLI.DLL
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: profapi.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: MSASN1.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\safelive.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: srvcli.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: VERSION.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: cscapi.dllJump to behavior
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: dbgcore.DLL
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: WININET.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: NETAPI32.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: Cabinet.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\PDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360verify.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\360verify.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: DEVRTL.dllJump to behavior
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: netutils.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360P2SP.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: IPHLPAPI.DLL
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: edputil.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: iertutil.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\7z.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: urlmon.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360net.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: WindowsCodecs.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeDLL: dbghelp.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dll
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeDLL: Wldp.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: TextShaping.dllJump to behavior
      EXE planting / hijacking vulnerabilities found
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Uninstall.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeEXE: regsvr32.exeJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exe
      Uses 32bit PE files
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      PE / OLE file has a valid certificate
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: certificate valid
      Contains modern PE file flags such as dynamic base (ASLR) or NX
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Binary contains paths to debug symbols
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdbNB10k source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb`` source: GBInst.exe, 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\UiFeatureControlSrc\UiFeature\Src\Pdb\UiFeature360Control.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007750000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2155392643.000000000358C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\shell360dt64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2311300071.00007FFBC1A7B000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdbNB10K source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebframe.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\Bin\360DeskTop\Release\BizPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8pJ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\shell360ext.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360NetUL\bin\360NetUL.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D47D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DesktopUi.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdbt source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTNotify.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb5 source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360MsgPushCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1623928497.00000000013F8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdbx source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1623928497.00000000013F8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Work\360se\extension2010\ExtNetIncrement\Output\ExtNetIncrement.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DTSwitchBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000002.2316212434.000000006C76F000.00000002.00000001.01000000.0000001F.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\desktoptool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb0` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SetupUtilDT.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2158601528.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\DownDll\Release\LiveUpd360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2136893687.000000000052B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\AppcenterDataGb.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdbXp\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebbrowser.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Net_2\Release\360net.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D47D000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119766154.0000000000530000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdbh source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\360TopBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000000.2171585841.0000000000579000.00000002.00000001.01000000.0000001A.sdmp, 360TopBar.exe, 00000015.00000002.2278081397.0000000000579000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBoxCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb``z source: GBInst.exe, 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\dtappcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA44000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\CloudTaskCenter_naive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360AppCenter.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B2EE000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\BoxUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_1.4.0.1085_20110902\bin\360DeskTop\Release\RegSMWebProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdbL source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\UiPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppUpdate.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360Apns.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360weibo.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdbxQJ source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\360Down\Release\LiveUpdate360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Ver.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2137479601.000000000326A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2269351092.0000000003A44000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D58F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdbP source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTCrashReport.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2147481812.0000000003583000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\somcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2054843186.0000000004250000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtfilm.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SomSoftMgrdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somQuickInstdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Desktop.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\svn\360desktop\branches\2.0.0.1120_201207016_B\Output\Bin\Release\SoftMgrLiteBase.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEC1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdbp source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTFence.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\Release\360wallpaper\version\DTCrashReport.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb`` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Desktop_20120814_2.3Release_appcore\bin\360DeskTop\Release\360AppCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\flashApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2105505074.0000000003269000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000000.2133758601.0000000000CC4000.00000002.00000001.01000000.00000014.sdmp, flashApp.exe, 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\code_svn\360SoftMgr\branches\GameMaster_1125_for_360dt\Output\Bin\Release\AppCenterCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360FeedBack\Release\360FeedBack.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Login\Release\oauthlogin.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\360GbApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\DTQuickInstProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdbH source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\PDown\Release\PDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2137640564.000000000052B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8p source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\Safelive\ReleaseUMinDependency\Safelive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DDF4000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2139079044.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\bin\Release\MiniUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628181945.0000000004088000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628668213.00000000046A8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1629220837.0000000001459000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2223371539.000000000B059000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA44000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somkernldt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360DesktopSetup\360TopbarASS\Release\360TopbarASS.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 0000000A.00000000.2072888648.0000000000B88000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\UpdateTool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb source: GBInst.exe, 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmp, GBInst.exe, 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: e:\360DeskTop_2.2.0.1070_20120618\bin\360DeskTop\Release\MsgBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DCD0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2054843186.0000000004250000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppcenterData.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\360GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\MusicIEFrame.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\02.WINDOWS\01.MyWork\01.UiFeature\01.SvnKing\trunk\KernelVersionCompany\Bin\Release\UiFeatureKernel.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2156205576.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,16_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00405D3A FindFirstFileA,FindClose,16_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00402630 FindFirstFileA,16_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,17_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_00405D3A FindFirstFileA,FindClose,17_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_00402630 FindFirstFileA,17_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C89EF80 _memset,_memset,PathAddBackslashW,FindFirstFileW,_memset,PathAddBackslashW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,19_2_6C89EF80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C74BF00 PathFindFileNameW,OpenProcess,_memset,GetModuleFileNameExW,K32GetModuleFileNameExW,GetProcessImageFileNameW,_memset,GetLogicalDriveStringsW,QueryDosDeviceW,_memset,_memset,_wcschr,GetLongPathNameW,_wcsncpy,FindCloseChangeNotification,21_2_6C74BF00
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppDataJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
      Source: Joe Sandbox ViewIP Address: 171.8.167.89 171.8.167.89
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=10047 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=2179 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=28509 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=6291 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=28540 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16080 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=24600&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=43609&r2=8823 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=9946 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa&w=6.2&t=6658734&active=1 HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: res.qhupdate.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /cms/guajian.html HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: static.apc.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /index.php?c=WallPaper&a=getAppsByDigest&start=0&count=100 HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: wallpaper.apc.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bdm/1280_1024_85/t01755cc43f58bff4ee.jpg HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: p1.qhimg.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=10437 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bdm/1280_1024_85/t01cedee08e9b9d07f7.jpg HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: p8.qhimg.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa&w=6.2&t=6671437&active=0 HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: res.qhupdate.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=1547 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32263 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=22406 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32713&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=122367&r2=3671 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=5251 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18212 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=6873 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=29683 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=24722 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B68060 InternetReadFile,10_2_00B68060
      Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Dec 2023 23:21:05 GMTContent-Type: text/htmlContent-Length: 21Connection: keep-aliveExpires: Thu, 28 Dec 2023 14:12:01 GMTServer: ApacheLast-Modified: Tue, 19 May 2020 09:34:07 GMTETag: "1-5a5fcfb2905a3"Accept-Ranges: bytesCache-Control: max-age=600Content-Encoding: gzipAge: 33544X-Cache: HIT from cache.51cdn.comX-Via: 1.1 PSrbJP1ty77:3 (Cdn Cache Server V2.0), 1.1 PS-DFW-04Eay52:9 (Cdn Cache Server V2.0)X-Ws-Request-Id: 658e02e1_PS-DFW-04xVs53_13627-23937Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 04 00 b7 ef dc 83 01 00 00 00 Data Ascii: 3
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=10047 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=2179 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=28509 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=6291 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=28540 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16080 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=24600&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=43609&r2=8823 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=9946 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa&w=6.2&t=6658734&active=1 HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: res.qhupdate.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /cms/guajian.html HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: static.apc.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /index.php?c=WallPaper&a=getAppsByDigest&start=0&count=100 HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: wallpaper.apc.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bdm/1280_1024_85/t01755cc43f58bff4ee.jpg HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: p1.qhimg.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=10437 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bdm/1280_1024_85/t01cedee08e9b9d07f7.jpg HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: p8.qhimg.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa&w=6.2&t=6671437&active=0 HTTP/1.1Accept: */*Accept-Language: zh-CNAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: res.qhupdate.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=1547 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32263 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=22406 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32713&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=122367&r2=3671 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=5251 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18212 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=6873 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=29683 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=24722 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: unknownDNS traffic detected: queries for: s.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ftp://https://.org.net.com.net.cn.com.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s/%s.trt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s/%u%u.html
      Source: flashApp.exeString found in binary or memory: http://%s/api.php?
      Source: flashApp.exeString found in binary or memory: http://%s/checkpwc.php
      Source: flashApp.exeString found in binary or memory: http://%s/intf.php
      Source: flashApp.exeString found in binary or memory: http://%s/intf.php?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://%s?https://%s?&from=parad=login.360.cnhttp://%s/intf.php?https://%s/intf.php?method=UserIntf.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1/%s;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1/%sfilename=resourcesfilesmetalink:/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://agd.p.360.cnSOFTWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.go108.cn/360zm/json/astro_everyday/day/Horoscope:%dlovecareer
      Source: flashApp.exeString found in binary or memory: http://api.qcloud.360.cn/intf.php
      Source: flashApp.exeString found in binary or memory: http://api.renren.com/restserver.do
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://api.renren.com/restserver.do%utinyurlWWW-Authenticate
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.renren.com/restserver.doSV
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.renren.com/restserver.doSVW
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.renren.com/restserver.doU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/account/verify_credentials.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/account/verify_credentials.json?U
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/oauth/access_token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/oauth/access_token?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/statuses/update.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/statuses/upload.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/%s/%s/members.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/%s/lists/%s/statuses.xmlper_pagehttp://api.t.sina.com.cn/statuses/user_time
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/account/verify_credentials.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/account/verify_credentials.xml?source=U
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/favorites.xmlhttps://api.weibo.com/2/favorites.jsonfavorites
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/friendships/create.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/friendships/create/%s.json?source=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/friendships/show.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/oauth/access_token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/oauth/access_tokenhttp://api.t.sina.com.cn/users/show/%s.json?source=%shttp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/shortUrl.xmlurl_shorttypeurl_longhttp://api.t.sina.com.cn/friendships/creat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/counts.xmlhttps://api.weibo.com/2/statuses/count.jsoncountrtrepost
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/followers.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/friends.xmlhttps://api.weibo.com/2/friendships/friends.jsonnext_cu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/friends_timeline.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/mentions.xmlhttps://api.weibo.com/2/statuses/mentions.jsonhttps://
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/repost.xmlhttps://api.weibo.com/2/statuses/repost.jsonid=&status=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/update.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/update.xmlU
      Source: flashApp.exeString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xmlU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xmlhttp://api.t.sina.com.cn/statuses/update.xmlhttps://api.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xmlstatus&oauth_signatureOAuth
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/users/show.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/users/show.xmlhttps://api.weibo.com/2/users/show.jsoncmttypemention_status2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/users/show/%s.json?source=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://auto.search.msn.comGIF89a
      Source: 360TopBar.exeString found in binary or memory: http://bbs.360.cn/5473920.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.360.cn/5473920.htmlCPictureGridPicker::ScrollTo:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.360safe.com/forum-883-1.htmlhttp://weibo.com/360gamebox%s?action=mgbosskey&state=%d&from=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B8F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.360safe.com/forum.php?mod=forumdisplay&fid=118&tj=pczhuomian360FeedBack.xmlSoftware
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.ioage.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.ioage.com/cn/forum-33-1.html
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bdmbdr//dr/%d_%d_%d.jpg%d_%d_%d_%dmuti_desc%d_%dspecial_%d_%d/bdm/%d_%d_%dclass_idurl_thumb31
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bizhi.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000000.2133758601.0000000000CC4000.00000002.00000001.01000000.00000014.sdmp, flashApp.exe, 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://bizhi.360.cn/
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bizhi.360.cn/#360
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bizhi.360.cn/uploadwallpaper.html360
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C177000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bsalsa.com/
      Source: explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.0000000009255000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B8F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://care.help.360.cn/care/uploadverifytagsys
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdata.browser.360.cn/api.php?a=switch&m=set&stamp=%s&sign=%s&qt=%s&app=%s&status=%sExt-Data;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=Ad&a=show&appid=%lu&m=%s&modulever=%s&appver=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=AppRelate&a=showList&appid=%lu&mid=%s&modulever=%s&appver=%s&bd=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getAppStatus&dtver=%s&mid=%sversion%lu%%3A%s%%2Capps=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getInfoByAppid&appid=%s&display_column=utag
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getListByTag&cid=%lu&page=%lu&sort=%s&tag=%s&ver=v2htt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getPresetUpdateApps%shttp://cdn.apc.360.cn/index.php?c
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getRecommendApps2&appid=%d&mid=%s&dtver=%s&mode=%dhttp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientClass&a=getList&ver=v2http://cdn.apc.360.cn/index.php?c=Clie
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dGameDownloadResultLaunchGame
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dopenMobileMgrisMobileMgrExistis360SafeE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dyingyongdianjihttp://stat.apc.360safe.c
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=getEvent&qid=%s&event=%s84D988A6-79F3-3360-01CN-BE29SDES
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=getTimeTamptimefix/w
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBoxClient&a=championNotice&qid=%sapp_namerival_name
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=VideoScreen&a=getPlayInfo&appid=%utitlesrc_allplay_titles
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WallPaper&a=getAppsByTagsFromCategory&from=360desktop&cids=%d&tags
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WallPaper&a=getAppsInfoByIds&ids=%sDownloadFavoriteProcess
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WebApp&a=show&appid=%lu&from=360dtclosesuccrawUrlloginedUrl%st
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WebApp&a=show&appid=%lu&from=360dtsuccrawUrlloginedUrlweb
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.weather.hao.360.cn/sed_api_weather_info.php?app=desktop&fmt=json&code=%darea(%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.weather.hao.360.cn/sed_api_weather_info.php?app=safeDestop&fmt=json&code=%shttp://weather
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://chrome.360.cn/pdown://h3=60
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://client.apc.360.cn/cms/360dtconf.inid
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cloud.openapi.360.cncookie_qcookie_t/app/add_list?uid=%s&ver=1.0Content-Type:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cmsg.browser.360.cn/api.php?qt=Get
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.geotrust.com/crls/gtglobal.crl04
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteCodeSigningCA.crl0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2268138626.0000000003A50000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
      Source: explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.0000000009255000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
      Source: explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2259478320.0000000009237000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dapp.wan.360.cn/360desk/mhxx?scrol=no&height=&r=1328833800D
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://data.weibo.com/top/topic?t=hourU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://desk.score.svc.1360.com/get?qid=%s&sign=%sLoginBallShowCountLoginGuideShowLLoginGuideShowHGui
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://desk.score.svc.1360.com/incr?event=%s&qid=%s&value=%d&sign=%s%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://desktop.360.cn/update/update.nxdbupdate.nxdb.newupdate.xdb.new
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dl.360safe.com/softmupdate/onekeyinstall.cabpdown://http://dlleak.360safe.com/leak/ty/hcphotf
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dlleak6.360safe.com/leak/winxp/123456.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/gamebox/android/360gamebox.apkDlg.ConnectPopuphttp://stat.apc.360safe.com/ms
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://down.360safe.com/safesetup_2000.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2137640564.000000000052B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllPath
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2136893687.000000000052B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllPathopen
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllSOFTWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DDF4000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2139079044.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllopen
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://down.360safe.com/setup.exeSOFTWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeentry
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628181945.0000000004088000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628668213.00000000046A8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2137640564.000000000052B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe8
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000003.2270017193.0000000003C41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeH
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621866746.0000000000C77000.00000008.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DDF4000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2139079044.0000000003581000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2136893687.000000000052B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeN
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B8F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exehttp://down.360safe.com/setup.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/downchrome.inichromeconfigurl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/downchrome.inichromeconfigurl360webapp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/mini_installer.exedownloadpdown://h3=60
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/setup.exeUpdateApplicationsAppDownloadCloseUpdateNewUpdateApplicati
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://errsug.se.360.cn/ch.html?m=%s&v=%s&qt=%s&qid=%s&n=%s&mn=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fastmm.sourceforge.net).
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gamebox.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gamebox.360.cn360yxhezi13a22fc0a
      Source: flashApp.exeString found in binary or memory: http://graph.renren.com/oauth/token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://graph.renren.com/oauth/tokenhttps://graph.renren.com/oauth/tokenrenren
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://graph.renren.com/renren_api/session_key?oauth_token=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hd.360.cn/angrybirds/http://static.apc.360.cn/cms/olympics/game_winner.html/page=%d
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hd.360.cn/baobei&ids
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B90D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://help.360.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://https://DecodePNGimg_reader.dll%s.uiz~mytmpimage_file_%srb
      Source: flashApp.exeString found in binary or memory: http://i.360.cn/findpwd/?src=%s&mid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://i.360.cn/profile/index2927http://i.360.cn/profile/chusername
      Source: flashApp.exeString found in binary or memory: http://i.360.cn/reg?src=%s&mid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://i.360.cn/reg?src=%s&mid=%shttp://i.360.cn/findpwd/?src=%s&mid=%sEDITLISTBOXD
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://i3.feixin.10086.cn/%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/appmenugouwu.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menubagua.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menulicai.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menushenghuo.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menushipin.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menutupian.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuxitong.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyinyue.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyo
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyouxi.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyuedu.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/05/shame_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/0c/sw_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/0c/ws_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/13/sweat.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/17/ldln_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/19/hate.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/1b/gz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/1b/m_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/29/bz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/33/camera_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/40/come_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/40/cool_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/41/zz2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/46/zxc_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/48/sx_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/4b/paoxiao_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/4d/crazy.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/57/angry.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/58/mb_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/58/pig.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/5c/yw_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/60/horse2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/64/cafe_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/64/hs_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6a/cake.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6a/laugh.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6d/heart.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6d/zhh_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6e/panda_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/70/vw_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/71/bs2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/73/wq_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7d/sleep_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7e/hei_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7e/love.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/81/rabbit_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/88/zgl_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/89/nm_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/8b/sleepy.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/8f/qq_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/90/money_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/91/d_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/98/yhh_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/9c/tz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/9e/t_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/a4/dizzy.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/a6/x_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/af/cry.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/af/kl_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b6/kbs_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b6/sb_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b8/cz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b8/green_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b9/moon.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bc/fuyun_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bc/otm_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bd/cheer.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c2/tooth.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c7/no_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c9/geili_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/ca/chunnuanhuakai_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d0/z2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d3/clock_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d6/ok_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d8/good_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d8/sad.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d8/sad_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d9/ye_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/e5/sun.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/e9/sk_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/ea/unheart.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/eb/smile.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f2/wg_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f3/k_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f4/cj_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://intf.soft.360.cn/index.php?c=Search&a=getSoftList&cver=v1&kw=%S&soft_ids=%s&%s%d-baoku%d-%sCS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://intf.zsall.mobilem.360.cn/intf/checkMobile?para=%s%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://intf.zsall.mobilem.360.cn/zsintf/getDownloadUrl?soft_ids=%s&market_id=&appver=%s&uid=%s&pid=%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.org/license
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/cgi/pin.php?r=%d&p=%sSV
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/member/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/member/getpwd/getpwd0.php?entry=ssoS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/sso/getalt.php?entry=weibo360plugin&service=weibo360plugin&tgt=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/sso/login.php?entry=weibo360plugin&alt=%s&url=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/sso/prelogin.php?entry=weibo360plugin
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.openapi.360.cn/msg/check?session=%s&msgid=%s3A6539ADE038ACD6DBFA8A4D130E34A5
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.openapi.360.cn/usr/login
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.openapi.360.cn/usr/loginnickname:cookie:??unp=%s&un=%s&unp=%s&un=%shttp://profile.openapi.3
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.soft.360.cn/index.php?controller=Intf&action=get.Down.Url&soft_id=%d&no_view=1&ofmt=xml&%sh
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C177000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mail.163.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mail.S
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://monitoring.openapi.360.cn/desktop/nopen/id/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://my.360.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://news.baike.360.cn/fw/zt1/heixiazi.htmlhttp://bbs.360safe.com/forum-162-1.html
      Source: explorer.exe, 00000018.00000002.2255320125.0000000004405000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2197724368.0000000004405000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobeS
      Source: explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.0000000009255000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
      Source: explorer.exe, 00000018.00000002.2259478320.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.00000000090DA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.geotrust.com0K
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
      Source: 360TopBar.exeString found in binary or memory: http://open.app.360.cn/?from=360desktop_tray
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://open.app.360.cn/?from=360desktop_tray%stype=open&action=appcenter&from=youxiajiaotray&TrayMen
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://open.app.360.cn/?from=360desktop_trayhttp://bbs.360.cn/5473920.htmlTaskbarCreatedhW
      Source: 360TopBar.exe, 00000015.00000002.2316212434.000000006C76F000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://open.app.360.cn/?from=360desktop_trayhttp://bbs.360.cn/5473920.htmlTaskbarCreatedhWwl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p1.qhimg.com/t01300a29501effb80d.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p17.qhimg.com/t01786e375a7830d753.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p17.qhimg.com/t01f55a00a83c723f3d.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p19.qhimg.com/t01008d7e105188efac.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p2.qhimg.com/t016ca463057d8d4362.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p2s.f.360.cn/urlquery
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p5.qhimg.com/t019530ea43ea4d8d90.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p7.qhimg.com/t0187051ceab8c8d55c.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p8.qhimg.com/t011dbc6e088968ddd8.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p9.qhimg.com/t013736ff668d0555d4.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pdown.stat.360safe.com/dimana.htm&usetime=%d&downrate=%d&downlen=%I64u=&?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/360haohua/safe_chaoqiang.cab
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/gamebox/GBUpdateConfig_Manual.ini?tick=%lu..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/zhuomian/DtUpdateConfig_Manual.ini?tick=%dUpdateContentAttributeDownloadMainVers
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/zhuomian/DtUpdateConfig_Manual.ini?tick=%dhttp://pinst.360.cn/zhuomian/DtUpdateC
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://pinst.360.cn/zhuomian/reinst_beta.cab/URL:http://pinst.360.cn/zhuomian/reinst_final.cabmodule
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.56.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.ku6.com/refer/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.pptv.com/v/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.youku.com/player.php/sid/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/degree.html#tab=2#uhp=%s#un=%shttp://profile.openapi.360.cn/user/info.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/degree.html#uhp=%s#un=%shttp://profile.openapi.360.cn/msg/info.html?ve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/user/info.html?un=dockbar
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/user/popup.htmlGS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.se.360.cn/proxyerr.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pstat.p.360.cn/uplog.php0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pstat.p.360.cn/uplog.phpinfo0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_download_url.php?type=download_url&soft_ids=%s&%sOptions
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_polls.php?mid=%Shttp://q.soft.360.cn/get_polls.php?ofmt=json&mid=%Shttp://q
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_update_info.php?type=update_info&soft_ids=%s&lrtime=0&%snameubrief2vdisppti
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_update_info.php?type=update_info&soft_ids=%s&lrtime=0&%subrief2vdispptimesu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://reg.163.com/getpasswd/RetakePassword.jsp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://reg.163.com/reg/reg.jsp
      Source: 360TopbarASS.exeString found in binary or memory: http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 0000000A.00000000.2072888648.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=&count=16&show=1&version=catecidrela
      Source: 360TopbarASS.exe, 0000000A.00000002.2080970323.000000000083E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=08bcc5cf9e3fc589107741a5e999ecfa&cou
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://res.qhupdate.com/wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini%d.%dB:A:downloadpat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://rm.api.weibo.com/statuses/unread.xml
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhibox&from=2
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhiexit&from=4startfrom=4http://s.360.cn/bizhi/s.html?action=b
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=0&fangshi=2http://s.360.cn/bizhi/s.html?acti
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=0http://static.apc.360.cn/cms/guajian.htmlHi
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=7http://s.360.cn/bizhi/s.html?action=bizhiri
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=8
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=9dataimg_%d_%dtotal0errnogoodwallpaper.jsonh
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhiset&from=0&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhiset&from=1&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?%sfun=lifecycle&act=updatedownload&res=app
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?%sfun=lifecycle&act=updateopen&res=app
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?%sfun=link&act=%s&res=%s&r1=%s&r2=%s&r3=%s&wjj
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=%s&fun=%s&act=%d&res=%d&mid=%s&ver=%s&r1=%d&r2=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1923918855.000000000140C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2224935394.0000000003F2F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2224032969.0000000003E7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2160058813.0000000003265000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&ve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2273079673.0000000003E94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&ve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1718550227.0000000003E8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1874170082.0000000003EF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/tray.htm?m=%s&uid=%s&pid=%s&appver=%s&modulever=%s%u.%u.%u.%uName
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/tray.htm?m=%s&uid=%s&pid=%s&appver=%s&modulever=%shttp://m.openapi.360.cn/status.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/xiaoguanjia/xgj.html%s?action=shutdown&from=%d&appver=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s0.qhimg.com/lib/jquery/171.js
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s0.qhimg.com/st.360.cn/;bk_up;style/7e995a0e.css
      Source: explorer.exe, 00000018.00000000.2200750468.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.2196430865.0000000002C80000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000002.2258173693.0000000007710000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sd.p.360.cn/%s.trt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sd.p.360.cn/BB53D19C9D32290AC8A94E902D7CB0C86A7E01E1.trt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://se.360.cnU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seapp.stat.360safe.com/q.html?name=%s&appver=%s&mid=%s&c=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seapp.stat.360safe.com/ver.html?name=%s&p=%s&mid=%s&fa=%s&fb=%s&fc=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://setpass.app.se.360.cn/forget?type=mail
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seupdate.360safe.com/360webmail_ver2.ini%s%d.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seupdate.360safe.com/360webmail_ver2.ini?%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seupdate.360safe.com/360webmail_ver2.ini?%dSV
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sizzlejs.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://soft.360.cn/static/ess/class_lenovo.xml?t=%d&%shttp://soft.360.cn/static/ess/class_6_0.xml?t=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=onekeyinstall&softid=%u&succ=%d&update=%d&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=onekeyinstall&softid=%u&succ=%d&update=%d&0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=open&action=%s&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=web&action=time&htime=%d&etime=%d&u=%s&ie=%s&bug=%lu&%%%about:bl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=web&action=time&htime=%d&etime=%d&u=%s&ie=%s&bug=%lu&%%%mshtml.d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?xml=err&m=~DF
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?xml=err&m=~DFP.ScriptTypeScript..
      Source: 360TopBar.exeString found in binary or memory: http://softm.update.360safe.com/360deskup2m.cab
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.update.360safe.com/360deskup2m.cab10222201102021020621221110210213208218206204209203205
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000002.2316212434.000000006C76F000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://softm.update.360safe.com/360deskup2m.cab360AppCore%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.update.360safe.com/360gamebox/v3update.cab?src=%S&t=%d&%Supdate.ini360safe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.update.360safe.com/360gamebox/v3update.cab?src=360DtMgr&t=%d&%shttp://softm.update.360s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.360safe.com/360/?stype=changeskin&ver=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2054843186.0000000004250000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stat.360safe.com/360safeurl/?type=upnet&mid=%sFloating
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stat.360safe.com/login.html?type=login&from=%s&action=%s&style=%s&uid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stat.360safe.com/login.html?type=login_checksumfail&q_send=%s&vt_send=%d&q_recv=%s&vt_recv=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/ad.html?action=slidetimeout&appid=%lu&%stype=new&action=webapp-cpu&from=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/ad.html?action=slidetimeout&appid=%lu&UiFeature360CtrlAnimationBalloonWndClsA
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=dakaizhuce&%stype=new&action=zhuce&from=%s&r1=%s&ap
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=msgbox&from=%d&detail=%d&m=%s&modulever=%s&appver=%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=msgboxweibo&from=%s&detail=%s&uid=%s&pid=%s&m=%s&mo
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=runmsg&from=full&detail=run&m=%s&modulever=%s&appve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=runmsg&from=full&detail=run&open_msgbox360ID
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=zhucechenggong&360DesktopRegisterVerifyCodeDlg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html%s?type=open&action=%s&mod=%d&appid=%lu&fenleiid=%d&from=%d&style=fu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%dx%d%stype=new&action=newdtmusic&from=%d&appid=&0http://stat.apc.3
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=moviefunction&from=%d&fangshi=&sort=&r1=&%stype=n
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=newdtmusic&from=%d&appid=&bad
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=openfiles&from=%d&r1=fences&r2=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=performanceindex_button&from=%u&fangshi=%u&safeve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=tipsclick&from=%d&fangshi=%d&sort=&r1=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B2EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=open&action=appcenter&style=fullscreen&from=%d&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=open&action=yingyongdianji&mod=1&fangshi=%d&appid=%d&fenleii
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=SetAppwallpaper&from=1&fangshi=&appid=&r1=&r2=&r3=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=SetSyswallpaper&from=0&fangshi=&appid=&r1=&r2=&r3=&
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=bizhibubble&from=1LastCloudIdSoftware
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=bizhibubble&from=4http://stat.apc.360.cn/stat.html?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=bizhilunbo&from=%d&fangshi=%d&appid=%s&r1=&r2=&r3=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B90D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=feedback&from=%d&fangshi=%d&uid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendar&from=1&fangshi=1&r1=fences&r2=particu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendar&from=1&fangshi=2&r1=fences&r2=particu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendar&from=6&r1=fences&r2=particular&http:/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=genghuanbizhishezhi&from=1&fangshi=&http://stat.apc
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=genghuanbizhishezhi&from=2&fangshi=&CCapDeviceChang
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=gerenzhongxin&from=%d&mid=%s&uid=%sA3B6B07CF749024E
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=guanbiruanjian&from=&fangshi=&sort=&r1=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=msgremind&from=%d&appid=%s&http://stat.apc.360.cn/s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=1&uid=1&pid=h_home&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=3&uid=1&pid=h_home&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=1&uid=1&pid=h_home&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=startinstall&appver=%s&r1=%s&uid=1&pid=%s&m=%shttp:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1923918855.000000000140C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1874170082.0000000003EF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=startinstall&appver=2.6.0.1110&r1=2.6.0.1110&uid=1&
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=wpcommon&from=00
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000000.2133758601.0000000000CC4000.00000002.00000001.01000000.00000014.sdmp, flashApp.exe, 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=zidaiyingyong&from=7&fangshi=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=2&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=4&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=1000&uid=1&pid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=2&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=3&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=4&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=anzhuanganquanzhuomian&from=3&mod=%d&appver=%s&pac
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2271423008.0000000003EF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=anzhuanganquanzhuomian&from=3&mod=1&appver=2.6.0.1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=anzhuangyunxing&from=%d&appver=%s&packagever=%s&ui
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=bengkuilesorry&deskbanben=%s&deakbanhao=%s&t=%dMoz
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2147481812.0000000003583000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=bengkuilesorry&deskbanben=%s&deakbanhao=%s&t=%dfee
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=guanbicomputer&-reboothttp://stat.apc.360.cn/stat.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=guanbisuoyouruanjian&%shttp://stat.apc.360.cn/stat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=qieping&from=1&style=%d&PageMyAppFS.xml%windir%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=sequence&from=%d&r1=fences&%stype=new&action=xinji
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=shengjichengxu&from=1&http://stat.apc.360.cn/stat.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2224705306.000000000AFEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=tiyanjihua&from=1&appver=2.6.0.1110&packagever=2.6
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=update&360DTNotifyF3C85C74-71B1-4ac8-9C89-B9BE4DC4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=detailclick&from=1&uid=1&pid=h_hom
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/tmp.html%s?action=gj_appcore&from=1%s?action=gj_appcore&from=2&fangshi=%u&sor
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/webapp.html?%stype=webapp&action=error&appID=%d&host=%s&errorcode=%d&errortyp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html%s?action=%s&sid=%u&moduledownokmoduleinstallokmodulenoninstallT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html%s?action=%s&sid=%u&moduledownokmoduleinstallokmodulenoninstalld
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html%s?action=mgpopup&from=4&detail=1003&state=1&x
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?360Gbapp..
      Source: GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?action=mginst&state=
      Source: GBInst.exe, 00000010.00000002.2190699098.0000000000555000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?action=mginst&state=1&pid=ZMSilent&m=08bcc5cf9e3fc589107741a5e9
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?action=mgpopup&from=4&detail=2001&state=%d&x
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?http://stat.apc.360.cn/stat.html?%stype=open&action=somxmlLoadR
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.ioage.com/web/theworld2up.ini?2.4.1.9needfileSUBVER_%slanguages
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B2EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/apphotweb.htmlsysMaxtooltips_class32dcGP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/ertong/ertongleyuan.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/ertong/ertongleyuan.htmlhttp://static.apc.360.cn/cms/music/tingyinyue.h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/gamecomment.html?appid=%d&from=%dwebapp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/education.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/fashion.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/female.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/game.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/investment.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/life.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/magzine.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/music.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/news.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/novel.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/picture.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/shopping.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/social.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/tools.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/video.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/minivideo/index.htmlAnimImage
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/minivideo/noplayer.html360Desktop
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/minivideo/player.html?playUrl=%sspliter1spliter2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/music/tingyinyue.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007750000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2155392643.000000000358C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/novels/gcy.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007750000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2155392643.000000000358C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/novels/gcy.htmliBookMenu.Yahei.NormaliBookMenu.Yahei.Hover
      Source: GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/recommend_game_new.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/selected.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/selected.htmlhttp://client.apc.360.cn/cms/360dtconf.ini7
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/skin_uploadwebapp.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/theme/index.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/theme/index.htmlMusicIEFrame7
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/video/shipinhezi1.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/video/shipinhezi1.html%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/video/videoNew.html?context=%s&num=%s&count=%d
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/bztuijian.htmlhttp://s.360.cn/bizhi/s.html?action=bizhirightl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/show.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/show.phpTextSinaWeibo_CJPicLD_BeginTimeLD_EndTimebutton
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/weibo-share.html
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/weiboshare.html#
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper_feedback.htmlloopwallpaper.xml&r1=1&action=bizhiEntrance&from
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/xiaoxihezi/tankuang.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/feedback/index.html?appid=%d&name=%s360WebappLead2ArenaTipsClass360WebappGa
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/feedback/index.html?appid=%d&name=%swebgamecontrolpanel.xml360Desktop
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/other/app_center/app_poll_1_0.htmlSoftMgr_Notify
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/360GameBoxConf.xmlGameBox_ConnectingMobilePopup
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/popup/pop_bg.pngmap/set
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/rules.htmhttp://swf.baoku.360.cn/gamebox/exaward.htmhttp://swf.baoku
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htmI360AppCenterDataClientTypeTabVisible
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htmSettingCenter
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htmpdown://h3=30
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/Sound.zipStartDownload()
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/flashActiveX.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/flashActiveX.exe&..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/flashActiveX.exehttp://swf.baoku.360.cn/hzx/Flash32_11_3_win8_360.ocx..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/douban.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/jingfm.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t.163.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t.cn/Swi4kM
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t.cn/htzkKX
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://theworld.cn/http://ioage.com/http://www.ioage.com/Update
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tp3.sinaimg.cn/1751401422/50/5611920854/1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tuan.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tuan.360.cn/api/se2.php?rc=%d&fromid=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://uninstall.feedback.360.cn/360desktopuninstall.html?ver=%s&mid=%s&safever=%s&sysver=%s&is64=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://up.soft.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://up.soft.360.cnQuickInstLog0.0.0.0/index.php?c=Upload&a=upload&pjt=quickinst&ver=%s&mid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=1101&status=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=1101&status=25&change=local&mid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=1101&status=25&change=self&mid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B8F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=2300&status=%d%02xshell32.dllPrivateExtractIconsWuser32.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2136893687.000000000052B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/v3/safeup_lib64.cabhttp://update.360safe.com/v3/safeup_lib.cab360trayHandl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/zhuomian/music/SelectMusicConfig.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v.ifeng.com/include/exterior.swf?guid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.cnzz.com/c.php?id=30000496
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/Shopping.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/bagua.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/licai.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/shenghuo3.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/xitonggongju.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/yinyue.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/youxi3.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/yuedu.png
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAllCategoriesV2http://cdn.apc.360.cn/index.ph
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsByCategory&cid=%s&start=%d&count=%dhttp:/
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsByTagsFromCategory&cids=%s&start=%d&count
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsInfoByIds&ids=%s-995OpenSettingCenterDoOp
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsV3&cids=%s&start=%d&count=%dhttp://wallpa
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaperAloneRelease&a=qrcodeshow&url=%shttp://wallpaper.ap
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaperAloneRelease&a=srvhoverUpdateFinish
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cnjson_err/index.php?c=WallPaper&a=apiCrashReportbizhi.dump.360.cndump/uplo
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/bbs.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/bbs.htmlgame.360.cn&name=http://wan.360.cn/bbs/second.html?g=%shttp://wan.360.cnn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/cs
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/csgame.360.cn&name=http://wan.360.cn/bbs/second.html?g=%shttps://KeFuhttp://wan.36
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/fans
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profile
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileSVW
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileSf
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/atme
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/comments
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/messages?source=toptray
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/signup/signup.php?entry=360se
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/signup/signup.php?ps=u3&lang=zh
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/signup/signup.php?ps=u3&lang=zhU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/zt/s?k=
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://whttp://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsInfoByIds
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wpad.%s/wpad.dathttp://%s/wpad.datwpad
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2137479601.000000000326A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628181945.0000000004190000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628668213.00000000046A8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628549546.000000000320E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DCD0000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2137640564.000000000052B000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2143562136.000000000358E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2145548368.0000000003598000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2141532731.0000000002AE0000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000003.2135145181.000000000272E000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000013.00000003.2137062080.00000000026F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn//index.html127.0.0.1--
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/ConnectedState:%dCreateFile
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/custom/xukexieyi.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/privacy/index.htmlJoinExperiencePlan%stype=setting&action=tiyanshezhi&shezhi=%d&SO
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/shoujizhushou/index.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/sinaweibo.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/ucenter/faq.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/userexperienceimprovement.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/weishi/index.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/weishi/index.htmlres://%d/%s/%dDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/xukexieyi.html#zhuomianJ
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/yinsichengnuo.html#xiangqing23
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn;color=rgb(60
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cnMAINFRAME
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2152287783.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cnPublisher360
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360safe.com360o
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/baidu?word=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/baidu?word=%us&tn=ichuner_4_pg&ie=utf-8:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/index.php?tn=ichuner_2_pg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/s?tn=ichuner_4_pg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/s?wd=%shttp://www.google.com.hk/search?q=%s&client=aff-os-prius&hl=zh-CN&ie=gb2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.geotrust.com/resources/cps0(
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.go108.com.cn/openapp/360app/astrofate/result.php?iAstro=%dA3B6B07CF749024E2DB5A6DF0DF37D1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.cn/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=javascri
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.cn/search?client=aff-worldbrowser&channel=errorpage&forid=1&ie=utf-8&oe=UTF-8&hl=z
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=%s&i
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=%us:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/search?q=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/webhp?client=aff-worldbrowser&ie=utf-8&oe=UTF-8&hl=zh-CN
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ifeng.com&fromweb=other&AutoPlay=false
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.indyproject.org/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/help-appendix-04.htmhttp://www.theworld.cn/http://www.ioage.com/cn/help.htmT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/help-shortcut.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/help.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/index.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/plugins.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/skin.htmPA
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/thanks.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/browsemode.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/dailytips.ini$http://www.ioage.com/web/navierr.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/rendermode.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/frame_naverror.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/inst.htmhttp://www.ioage.com/web/uninst.htmUpgrade
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/navierrres:about:blank%s/Software
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/web_search_cn.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/welcome_cn.htm?ver=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.macromedia.com/go/getflashplayer
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.meilishuo.com/users/register
      Source: explorer.exe, 00000018.00000000.2202592501.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2259478320.0000000009237000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.c
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mogujie.com/register
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.planeart.cn/?p=1121
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.renren.com/md5LoginU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/sogou?query=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theworld.cn/client/downhttp://www.theworld.cn/client/up
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theworld.cn/client/syncfavsorder.db%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tudou.com/v/
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll-1.2.3rbr
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2151662607.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllincompatible
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DCD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllrbr
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yinyuetai.com/video/player/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://you.video.sina.com.cn/api/sinawebApi/outplayrefer.php/vid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhifu.openapi.360.cnMode
      Source: explorer.exe, 00000018.00000002.2269233438.000000000C114000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/00C91DA8863D472fB1873585577810F1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/360chromeinstalltips.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/360chromeinstalltips.html$
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ShowAppPermitDlg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/f&TCopyright
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exeString found in binary or memory: http://zhuomian.360.cn/ver2.0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000000.2171585841.0000000000579000.00000002.00000001.01000000.0000001A.sdmp, 360TopBar.exe, 00000015.00000002.2278081397.0000000000579000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0/reboot360DTSwitchBar.dllRunDLL
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0C:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0L
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0SetUnhandledExceptionFilterkernel32.dllGIF89a
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0Shell_TrayWnd
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0kernel32.dll360BoxCtrlCScrollMutliAppbox360DockBarCtrl360Desktop_CNBSug
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0kernel32.dllSetUnhandledExceptionFilteropenDTCrashReport.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0processinfo.dat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B2EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0somkernldt.dll..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0widthheightcallbackoncloseHWND=%lu;content=%sHWND=;content=T
      Source: explorer.exe, 00000018.00000000.2210890196.000000000C00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2268204766.000000000C00A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnReferertokenautologinerrno=vector
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://zhuomian.360.cnSwitchBar.xmlupdatecfg.inimodules
      Source: explorer.exe, 00000018.00000000.2210890196.000000000C00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2268204766.000000000C00A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnapni
      Source: explorer.exe, 00000018.00000000.2196504693.0000000002CD0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: http://zhuomian.360.cnhttp://zhuomian.360.cnhttp://zhuomian.360.cn360
      Source: explorer.exe, 00000018.00000000.2210890196.000000000C00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2268204766.000000000C00A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnrer
      Source: explorer.exe, 00000018.00000000.2210890196.000000000C00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2268204766.000000000C00A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnridm8
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnsomkernldt.dll..
      Source: flashApp.exeString found in binary or memory: https://%s/intf.php?
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2208854440.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2208854440.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2208854440.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSA4
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2208854440.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSd
      Source: explorer.exe, 00000018.00000000.2198948294.000000000702D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.000000000702D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
      Source: explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
      Source: explorer.exe, 00000018.00000002.2259478320.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.00000000090DA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
      Source: explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/friendships/create.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/friendships/followers.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/friendships/show.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/friends_timeline.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/update.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/upload.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/upload.jsonaccess_token1.jpgpic
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/users/show.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/users/show.json?access_token=%s&uid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/oauth2/U
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/oauth2/authorize?client_id=3977697501&redirect_uri=https%3A%2F%2Fconnect.360.c
      Source: explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
      Source: explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
      Source: explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdata.browser.360.cn/api.php?https://cdata.browser.360.cn/api.phpvtversiontype
      Source: explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.que
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://connect.360.cn/index.php?U
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feixin.10086.cn/account/register/CC_DelAccountResult
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp, flashApp.exeString found in binary or memory: https://graph.renren.com/oauth/token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://graph.renren.com/transfer?%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://graph.renren.com/transfer?%slogout
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.feixin.10086.cn/https://i2.feixin.10086.cn/https://i3.feixin.10086.cn/https://i5.feixin.10
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i2.feixin.10086.cn/api/user.json?access_token=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i2.feixin.10086.cn/api/user.json?access_token=%shttp://api.qcloud.360.cn/intf.phperror_descr
      Source: explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.ak
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.sina.com.cn/sso/login.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openapi.360.cn/internal/get_is_user_paid.json?q=%s&t=%spaynotify.xmlpaynotify_del.xmlheadima
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openapi.360.cn/internal/get_user_by_q_t.json?%sapp_key=%s&q=%s&t=%s&type=%d&name=%sD
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openapi.360.cn/internal/get_user_by_q_t.json?%sapp_key=%s&q=%s&t=%s&type=%d&name=%shttp://cd
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passport.360.cn/api.php?parad=http://passport.360.cn/api.php?parad=&from=360deskmethod=UserI
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comer
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rm.api.weibo.com/2/remind/unread_count.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://spreadsheets.google.com/http://spreadsheets.google.com/https://docs.google.com/http://docs.g
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
      Source: explorer.exe, 00000018.00000000.2208854440.000000000BDF5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/EM0
      Source: explorer.exe, 00000018.00000002.2266357108.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com48
      Source: explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
      Source: explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwwhttp://wwwTW.2.10%d:
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00404F1F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,16_2_00404F1F
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C733960 CreateDCW,CreateCompatibleDC,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,SelectObject,SelectObject,DeleteObject,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,DeleteDC,DeleteDC,BitBlt,PatBlt,DeleteDC,21_2_6C733960
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8CA120 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,_memset,lstrcpynA,CryptImportKey,CryptCreateHash,CryptSetHashParam,CryptHashData,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,19_2_6C8CA120
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B6F080: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle,10_2_00B6F080
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,16_2_00403225
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,17_2_00403225
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03D9E82F0_3_03D9E82F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03D9E93F0_3_03D9E93F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03D9E4A10_3_03D9E4A1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03D9E5210_3_03D9E521
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B8408310_2_00B84083
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B6307010_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7019010_2_00B70190
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B82A8E10_2_00B82A8E
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B76A3210_2_00B76A32
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7EB2710_2_00B7EB27
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7E34710_2_00B7E347
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B856E810_2_00B856E8
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7DE7210_2_00B7DE72
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7B7AE10_2_00B7B7AE
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B70FE010_2_00B70FE0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B82FD210_2_00B82FD2
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7E71B10_2_00B7E71B
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7EF4710_2_00B7EF47
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_3_037C6B4816_3_037C6B48
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_3_037C14F016_3_037C14F0
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_3_037CB0B016_3_037CB0B0
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0040600A16_2_0040600A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0040473016_2_00404730
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0379FF5F16_2_0379FF5F
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_037A0B9B16_2_037A0B9B
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0379FA1B16_2_0379FA1B
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0379168016_2_03791680
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0379A84516_2_0379A845
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_037A18FC16_2_037A18FC
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_037A04A316_2_037A04A3
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_0040600A17_2_0040600A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_0040473017_2_00404730
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F214F017_2_02F214F0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F2B0B017_2_02F2B0B0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F26B4817_2_02F26B48
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CAE6D019_2_00CAE6D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CB119019_2_00CB1190
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CC199219_2_00CC1992
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CAE15019_2_00CAE150
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CC138919_2_00CC1389
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CC1CB019_2_00CC1CB0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CA16A019_2_00CA16A0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CC0E4519_2_00CC0E45
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CA8E7019_2_00CA8E70
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CB674119_2_00CB6741
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CBD73819_2_00CBD738
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8C148019_2_6C8C1480
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C934C1819_2_6C934C18
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C92EDD919_2_6C92EDD9
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C92EDC019_2_6C92EDC0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8FEDF019_2_6C8FEDF0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C902EF019_2_6C902EF0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C908F3019_2_6C908F30
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C906A8019_2_6C906A80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8D0B8019_2_6C8D0B80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C9365B519_2_6C9365B5
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C9346D419_2_6C9346D4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8A861019_2_6C8A8610
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C92063019_2_6C920630
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C91C71419_2_6C91C714
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8B60D019_2_6C8B60D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C91C2F419_2_6C91C2F4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8A425019_2_6C8A4250
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8D239019_2_6C8D2390
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8B63E019_2_6C8B63E0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8C3D8019_2_6C8C3D80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C931EC319_2_6C931EC3
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C91BEE819_2_6C91BEE8
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C93585419_2_6C935854
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C92990019_2_6C929900
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C911A5019_2_6C911A50
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8A7BC019_2_6C8A7BC0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8B3BD019_2_6C8B3BD0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C91BB1419_2_6C91BB14
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8D350019_2_6C8D3500
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C91B63F19_2_6C91B63F
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C90708019_2_6C907080
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C93515C19_2_6C93515C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C90729019_2_6C907290
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C9173F219_2_6C9173F2
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_00566AA021_2_00566AA0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_00575BF521_2_00575BF5
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_0056F7FB21_2_0056F7FB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C74BF0021_2_6C74BF00
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C755E4021_2_6C755E40
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C76BE4C21_2_6C76BE4C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C769F6B21_2_6C769F6B
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C76A9F321_2_6C76A9F3
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C75CB9221_2_6C75CB92
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C76A4AF21_2_6C76A4AF
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C76B0EB21_2_6C76B0EB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C7672ED21_2_6C7672ED
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: String function: 03799F4C appears 34 times
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: String function: 00B76FF8 appears 42 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 00CB4094 appears 48 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C908655 appears 37 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C901210 appears 146 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C921A70 appears 50 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C921B90 appears 39 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C897530 appears 37 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C899710 appears 31 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C8A4240 appears 124 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C921B50 appears 83 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C90C28C appears 58 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: String function: 6C75A97C appears 47 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: String function: 0056A0AC appears 37 times
      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4084 -s 10344
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: DLL type: 7-zip archive data, version 0.4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 213427 bytes, 1 file, at 0x2c +A "7z.dll", number 1, 12 datablocks, 0x1 compression
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: OEMDATA type: 7-zip archive data, version 0.3
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: SETUPCONFIG type: 7-zip archive data, version 0.4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: SKIN type: 7-zip archive data, version 0.4
      Source: 360mwapp.exe.0.drStatic PE information: Resource name: RT_RCDATA type: COM executable for DOS
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
      Source: 360weibo.exe.0.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
      Source: Uninstall.exe.0.drStatic PE information: Resource name: OEMDATA type: 7-zip archive data, version 0.3
      Source: Uninstall.exe.0.drStatic PE information: Resource name: SKIN type: 7-zip archive data, version 0.4
      Source: 360seNotify.exe.0.drStatic PE information: Number of sections : 12 > 10
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\017TCWeiBoEditForm\016CWeiBoEditForm\013BorderStyle\007\006bsNone\007Caption\022\005'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\030TCWeiboPuzzlePicEditForm\027CWeiboPuzzlePicEditForm\013BorderStyle\007\006bsNone\007Caption\006\027CWeiboPuzzlePicEditForm\014ClientHeight\003"\001\013ClientWi'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\030TCWeiboPuzzlePicItemForm\027CWeiboPuzzlePicItemForm\013BorderStyle\007\006bsNone\007Caption\006\027CWeiboPuzzlePicItemForm\014ClientHeight\003\014\001\013ClientWi'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\027TMsgBoxClientAnchorForm\026MsgBoxClientAnchorForm\013BorderStyle\007\006bsNone\007Caption\022'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TRemindItemBasicForm\023RemindItemBasicForm\013BorderStyle\007\006bsNone\007Caption\006\023RemindItemBasicForm\014ClientHeight\003\027\001\013ClientWidth\003\346\001\005Color'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TShareImgPreviewForm\023ShareImgPreviewForm\013BorderStyle\007\006bsNone\013BorderWidth\002\001\007Caption\022\004'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TShareLoginBasicForm\023ShareLoginBasicForm\013BorderStyle\007\006bsNone\007Caption\006\023ShareLoginBasicForm\014ClientHeight\003\320'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\032TShareSendResultAnchorForm\031ShareSendResultAnchorForm\013BorderStyle\007\006bsNone\007Caption\006\031ShareSendResultAnchorForm\014ClientHeight\003\320'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TSinaSsoLoginingForm\023SinaSsoLoginingForm\013BorderStyle\007\006bsNone\007Caption\024\011'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\022TUfClientBasicForm\021UfClientBasicForm\013BorderStyle\007\006bsNone\007Caption\006\021UfClientBasicForm\014ClientHeight\003\027\001\013ClientWidth\003\262\001\005Color\004\361\366\371'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\021TUfTodayTopicForm\020UfTodayTopicForm\013BorderStyle\007\006bsNone\007Caption\022\004'
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTPreview.EXE: vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2223568889.0000000003F2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameREGSVR32.EXEj% vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell360ext.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSMWebProxydt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEC1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSoftMgrLiteBase.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlproc.DLL vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlprocnet.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDTQuickInstProxy.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtwebbrowser.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628181945.0000000004088000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2268138626.0000000003A4B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Verify.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1630289477.0000000003219000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2137479601.000000000326A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Ver.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: F\VarFileInfo\Translation000%x\StringFileInfo\%s\OriginalFileName%sSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe%u.%u.%u.%u\deepscan\cloudsec2.dllDSAsyncEvaluateExechttp://stat.apc.360.cn/tmp.html%s?action=gj_appcore&from=1%s?action=gj_appcore&from=2&fangshi=%u&sort=%uroconfig.iniAppCoreNotDelayQuitappUser32.dllChangeWindowMessageFilterhttp://softm.update.360safe.com/360appupdate.cab vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360AppCo.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Desktop.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLiveUpdate360.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMusicIEFrame.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWebLogin.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRegSMWebProxy.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSetupUtilDT.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSpecialBuildProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSetup.exe8 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameGameBox.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameGameBoxCore.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDumpReport.rc2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameflashApp.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlproc.DLL vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlprocnet.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360TopBar.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360TopbarASS.exe: vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360wapp.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSomSoftMgrdt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeature360Control.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDown360Notify.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePDown.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: SSpecialBuildProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628668213.00000000046A8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppcenterDataGb.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRegularSutdown.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCloudTaskCenter_naive.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \JudgeVersionc:\test\xLogConfig.ini..\xLogConfig.inilogfilter360DesktoplogDirName\Logs.logAppCenterData.dllCreateAppCenterIPCMgr\VarFileInfo\Translation000%x\StringFileInfo\%s\OriginalFileName%sSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe\deepscan\bapi.dll360Topbar.exe360AppCore.exe"%s" /autorunSOFTWARE\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Run/autorun360DesktopMainProg%s\*.*...find_first_file error [%d] vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtappcore.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B3F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360AppCenter.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesomcoredt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360ZMUDetail.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeatureKernel.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiPluginCake.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2223371539.000000000B043000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2054843186.0000000004250000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlprocnet.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Inst.exe vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360mwapp.exe vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2105505074.0000000003269000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameflashApp.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360MsgPushCore.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2223921502.0000000003F34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameREGSVR32.EXEj% vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D812000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppcenterData.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360weibo.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360seNotify.rs" vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B90D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360FeedBack.exe vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1623928497.00000000013F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7za.dll, vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA44000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDTShutdown.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA44000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtswitcher.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2267647901.000000000326A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Common.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTFence.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007750000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeature360Control.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppUpdate.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBizPluginCake.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBoxUI.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360GbApp.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreen.exe, vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedesktoptool.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesomkernldt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesomQuickInstdt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameimg_reader.dll6 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLiveUpd360.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Common.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopAssistant.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopMenu.DLL0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopUi.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C177000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename30seNotify.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1623745515.0000000003218000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7za.dll, vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D47D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360net.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D47D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360NetUL.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2269351092.0000000003A44000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Ver.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDTCrashReport.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtfilm.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Verify.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppCenterCore.dll@ vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUpdateTool.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Apns.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D58F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Ver.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360P2SP.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DDF4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSpecialBuildProductVersionProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DDF4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSafelive.DLL0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtswitcher.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtwebframe.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameExtNetIncrement.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopSwitch.exe: vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTNot.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360GameBox.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DCD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsgBox.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTSwitchBar.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSpecialBuildProductVersionProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeatureKernel.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiPluginCake.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D39F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Login.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeSection loaded: dtunloader64.dll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: 360seNotify.exe.0.drStatic PE information: Section: .reloc IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      Source: classification engineClassification label: mal51.evad.winEXE@36/924@30/7
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C921230 SetLastError,GetLastError,SetLastError,GetLastError,_wcsrchr,_wcsncpy,_strerror,MultiByteToWideChar,_wcsncpy,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,FormatMessageW,_wcstok,_vswprintf_s,_wcsncpy,GetSystemTime,LocalFree,FreeLibrary,19_2_6C921230
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,16_2_00404275
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_00561160 lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle,21_2_00561160
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00402012 CoCreateInstance,MultiByteToWideChar,16_2_00402012
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CAC1E0 LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,19_2_00CAC1E0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\s[1].htmJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeMutant created: \Sessions\1\BaseNamedObjects\360DtUnInstaller
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 4584
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeMutant created: \Sessions\1\BaseNamedObjects\Local\360_login_account_config_lock2
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 6116
      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4084
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5392
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 4656
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 3688
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 4940
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 1992
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeMutant created: \Sessions\1\BaseNamedObjects\Local\360Login_mapping_lock
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeMutant created: \Sessions\1\BaseNamedObjects\DT_TOPBAR_{8AB1E186-A11B-476f-B8EB-83D0A6E5009E}
      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3748
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeMutant created: \Sessions\1\BaseNamedObjects\360WallPaper_By_Zhangtao
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeMutant created: \Sessions\1\BaseNamedObjects\360DtInstaller
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeMutant created: \Sessions\1\BaseNamedObjects\360desktop_appcore
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{40FDEBEB-AB66-4601-98EB-C4DE74916AE9}.tmpJump to behavior
      Source: Yara matchFile source: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.exe, type: DROPPED
      Source: unknownProcess created: C:\Windows\explorer.exe
      Source: unknownProcess created: C:\Windows\explorer.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cate10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: count10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: count10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cate10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cid10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: relate_type10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cid10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: relate_type10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: zm_d10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: 1000410_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: version10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: 1.010_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: encoding10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: UTF-810_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: standalone10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: child10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: book10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: \360Desktop10_2_00B63070
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCommand line argument: RunDLL21_2_00561DF0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT aid , cid FROM customcategoryappmap;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT aid , cid FROM customcategoryappmap_cm;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT info FROM tempappinfos WHERE aid IN %s ;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT info FROM appinfos WHERE aid IN %s ;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT aid , cid FROM customcategoryappmap_disneymode;
      Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe "C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe "C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe" onlyimport
      Source: unknownProcess created: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4084 -s 10344
      Source: unknownProcess created: C:\Windows\explorer.exe explorer.exe
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe StartByDesktop StartFrom=4
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3748 -s 5128
      Source: unknownProcess created: C:\Windows\explorer.exe explorer.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe" /unloaddtswitcher
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe StartByDesktop StartFrom=4
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile written: C:\Program Files (x86)\360\360Desktop\updatecfg.iniJump to behavior
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: certificate valid
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic file information: File size 22004296 > 1048576
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdbNB10k source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb`` source: GBInst.exe, 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\UiFeatureControlSrc\UiFeature\Src\Pdb\UiFeature360Control.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007750000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2155392643.000000000358C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\shell360dt64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2311300071.00007FFBC1A7B000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdbNB10K source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebframe.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\Bin\360DeskTop\Release\BizPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8pJ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\shell360ext.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360NetUL\bin\360NetUL.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D47D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DesktopUi.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdbt source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTNotify.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb5 source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360MsgPushCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1623928497.00000000013F8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdbx source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1623928497.00000000013F8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Work\360se\extension2010\ExtNetIncrement\Output\ExtNetIncrement.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DTSwitchBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000002.2316212434.000000006C76F000.00000002.00000001.01000000.0000001F.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\desktoptool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb0` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SetupUtilDT.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2158601528.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\DownDll\Release\LiveUpd360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2136893687.000000000052B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\AppcenterDataGb.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2148345936.000000000359B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdbXp\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebbrowser.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Net_2\Release\360net.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D47D000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119766154.0000000000530000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdbh source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\360TopBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000000.2171585841.0000000000579000.00000002.00000001.01000000.0000001A.sdmp, 360TopBar.exe, 00000015.00000002.2278081397.0000000000579000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBoxCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2150114064.0000000003590000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb``z source: GBInst.exe, 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\dtappcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA44000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\CloudTaskCenter_naive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360AppCenter.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B2EE000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\BoxUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_1.4.0.1085_20110902\bin\360DeskTop\Release\RegSMWebProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdbL source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\UiPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppUpdate.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360Apns.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360weibo.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdbxQJ source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\360Down\Release\LiveUpdate360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Ver.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2137479601.000000000326A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2269351092.0000000003A44000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D58F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdbP source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTCrashReport.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2147481812.0000000003583000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\somcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2054843186.0000000004250000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtfilm.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C939000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SomSoftMgrdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somQuickInstdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Desktop.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\svn\360desktop\branches\2.0.0.1120_201207016_B\Output\Bin\Release\SoftMgrLiteBase.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEC1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdbp source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTFence.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\Release\360wallpaper\version\DTCrashReport.pdb source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb`` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Desktop_20120814_2.3Release_appcore\bin\360DeskTop\Release\360AppCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\flashApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2105505074.0000000003269000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000013.00000000.2133758601.0000000000CC4000.00000002.00000001.01000000.00000014.sdmp, flashApp.exe, 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\code_svn\360SoftMgr\branches\GameMaster_1125_for_360dt\Output\Bin\Release\AppCenterCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360FeedBack\Release\360FeedBack.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Login\Release\oauthlogin.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\360GbApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\DTQuickInstProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdbH source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\PDown\Release\PDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2137640564.000000000052B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8p source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\Safelive\ReleaseUMinDependency\Safelive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DDF4000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2139079044.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\bin\Release\MiniUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628181945.0000000004088000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628668213.00000000046A8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1629220837.0000000001459000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2223371539.000000000B059000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA44000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somkernldt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360DesktopSetup\360TopbarASS\Release\360TopbarASS.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 0000000A.00000000.2072888648.0000000000B88000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\UpdateTool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D040000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb source: GBInst.exe, 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmp, GBInst.exe, 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: e:\360DeskTop_2.2.0.1070_20120618\bin\360DeskTop\Release\MsgBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DCD0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2054843186.0000000004250000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppcenterData.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\360GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\MusicIEFrame.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\02.WINDOWS\01.MyWork\01.UiFeature\01.SvnKing\trunk\KernelVersionCompany\Bin\Release\UiFeatureKernel.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2156205576.0000000003581000.00000004.00000020.00020000.00000000.sdmp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B8023C LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,10_2_00B8023C
      Source: 360Common.dll.0.drStatic PE information: section name: history
      Source: 360MsgPushCore.dll.0.drStatic PE information: section name: .share
      Source: Safelive.dll.0.drStatic PE information: section name: .IShareO
      Source: Shell360dt.dll.0.drStatic PE information: section name: .orpc
      Source: Shell360dt64.dll.0.drStatic PE information: section name: .orpc
      Source: somkernldt.dll.0.drStatic PE information: section name: .data1
      Source: urlproc.dll.0.drStatic PE information: section name: .SHARE
      Source: 360seNotify.exe.0.drStatic PE information: section name: .didata
      Source: 360seNotify.exe.0.drStatic PE information: section name: QProtect
      Source: 360weibo.exe.0.drStatic PE information: section name: .share
      Source: DTCrashReport.exe.0.drStatic PE information: section name: .share
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03D9BBC0 pushfd ; ret 0_3_03D9BBC1
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7703D push ecx; ret 10_2_00B77050
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B72936 push ecx; ret 10_2_00B72949
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_3_037C3AB0 push eax; ret 16_3_037C3ADE
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_03799F91 push ecx; ret 16_2_03799FA4
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F23AB0 push eax; ret 17_2_02F23ADE
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CB40D9 push ecx; ret 19_2_00CB40EC
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C90C9A6 push ecx; ret 19_2_6C90C9B9
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C90C2D1 push ecx; ret 19_2_6C90C2E4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_0056A846 push ecx; ret 21_2_0056A859
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_0056A0F1 push ecx; ret 21_2_0056A104
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_005649B0 push ecx; mov dword ptr [esp], 00000000h21_2_005649B1
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C753DA0 push ecx; mov dword ptr [esp], 00000000h21_2_6C753DA1
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C75A9C1 push ecx; ret 21_2_6C75A9D4

      Persistence and Installation Behavior

      barindex
      Contains functionality to infect the boot sector
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d10_2_00B6F080
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d10_2_00B6F440
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d10_2_00B6F5D0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d17_2_02F22480
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d17_2_02F21F40
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d17_2_02F22300
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d19_2_6C91F8D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d19_2_6C91FA60
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d19_2_6C91F510
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_00566360
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_005663C9
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_6C755769
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_6C755700
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360AppCenter.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\BoxUI.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\360wpappInstaller_zhuomian.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\PDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\MusicIEFrame.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\NSISdl.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360verify.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\UpdateTool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360wapp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\7z.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ImportFavHelper.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\SetupHelperGB.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\DTShutdown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360Login.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Shell360dt64.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtswitcher.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtwebframe.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopAssistant.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\360net.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopUi.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTSwitchBar.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\GBInst.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtfilm.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\PDown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\LiveUpdate360.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\AppcenterDataGb.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360NetUL.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\LiveUpdate360.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Common.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\360P2SP.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\oauthlogin.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\ExtNetIncrement.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\360weibo.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\desktoptool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360dtpreview.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\NotifyDown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GameBox.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtwebbrowser.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBox.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SoftMgrLiteBase.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtswitcher64.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTFence.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\CatchScreenTray.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\360GbApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\AppcenterDataGb.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\DumpReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Uninstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\BoxUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTNotify.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtappcore.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\sqlite3.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GbApp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtwebframe.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher64.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\NSISdl.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmpJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360MsgPushCore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360net.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Login.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360NetUL.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.rsJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\CloudTaskCenter_naive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\AppcenterData.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtappcore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360AppCore.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somkernldt.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\360verify.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360verify.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopSwitch64.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UpdateTool.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\360GameBox.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppCenterCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppUpdate.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GameBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopMenu.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\CloudTaskCenter_naive.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\Registry.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SMWebProxydt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\RegSMWebProxy.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\360mwapp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{FFB457B7-D39B-4777-A970-75B9F9B81322}.tmp\MiniUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Desktop.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\RegSMWebProxy.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360verify.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\PDown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\BizPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\flashApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTShutdown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\ImportFavHelper.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\MiniUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360ZMUDetail.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppcenterData.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\safemon\urlproc.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\MsgBox.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\DTCrashReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\sqlite3.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\360TopbarASS.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{32DE70BA-1395-4dff-A45D-DE76DE00B289}.tmpJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\DumpReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SomSoftMgrdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtwebbrowser.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360ZMUDetail.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\360verify.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DTSwitchBar.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBoxCore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtfilm.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\AppCenterCore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360MsgPushCore.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360TopBar.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360weibo.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360wapp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{786DF1B6-83F7-43fe-8CAF-75FCED58443B}.tmp\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\AppUpdate.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\DTQuickInstProxy.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\MsgBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTQuickInstProxy.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somcoredt.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\registry.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\safemon\urlprocnet.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\LiveUpd360.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopSwitch.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Shell360dt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\360Inst.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somQuickInstdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\ExtNetIncrement.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\RegularShutdown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360P2SP.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360net.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360Ver.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\MusicIEFrame.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360FeedBack.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\desktoptool.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\SetupUtilDT.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\BizPluginCake.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\img_reader.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\CatchScreenTray.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\img_reader.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\360Inst.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.rs (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Ver.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Apns.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.rsJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C747820 _memset,SHGetFolderPathW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,PathFileExistsW,_memset,GetPrivateProfileStringW,PathFileExistsW,DeleteFileW,ShellExecuteW,21_2_6C747820

      Boot Survival

      barindex
      Contains functionality to infect the boot sector
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d10_2_00B6F080
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d10_2_00B6F440
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d10_2_00B6F5D0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d17_2_02F22480
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d17_2_02F21F40
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d17_2_02F22300
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d19_2_6C91F8D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d19_2_6C91FA60
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d19_2_6C91F510
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_00566360
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_005663C9
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_6C755769
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_6C755700
      Creates an undocumented autostart registry key
      Source: C:\Windows\System32\regsvr32.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\360DesktopExt NULL
      Source: C:\Windows\System32\regsvr32.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\360DesktopExt NULL
      Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeWindow searched: window name: Progman
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8EC240 InvalidateRect,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,19_2_6C8EC240
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8EC240 InvalidateRect,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,19_2_6C8EC240
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8EB0D0 InvalidateRect,SetWindowPos,SetWindowPos,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,19_2_6C8EB0D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8EB0D0 InvalidateRect,SetWindowPos,SetWindowPos,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,19_2_6C8EB0D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C8EB320 IsWindow,IsWindowVisible,IsWindow,IsWindowVisible,IsWindow,IsWindowVisible,IsWindow,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,19_2_6C8EB320
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C924040 LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetLastError,19_2_6C924040
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Yara detected AntiVM3
      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe PID: 6116, type: MEMORYSTR
      Query firmware table information (likely to detect VMs)
      Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
      Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SBIECTRL.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSNIFFER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\SBIECTRL.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WINDBG.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FIDDLER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: EHSNIFFER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\WIRESHARK.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\FIDDLER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VSNIFFER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
      Source: C:\Windows\explorer.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 388
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360AppCenter.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\CloudTaskCenter_naive.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\RegSMWebProxy.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\BoxUI.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\MusicIEFrame.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\PDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\360mwapp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{FFB457B7-D39B-4777-A970-75B9F9B81322}.tmp\MiniUI.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\UpdateTool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360wapp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Desktop.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\RegSMWebProxy.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\PDown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ImportFavHelper.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\DTShutdown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\BizPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTShutdown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\ImportFavHelper.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\MiniUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360ZMUDetail.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\safemon\urlproc.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtwebframe.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtswitcher.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppcenterData.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\MsgBox.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopAssistant.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\360net.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\DTCrashReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\sqlite3.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopUi.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{32DE70BA-1395-4dff-A45D-DE76DE00B289}.tmpJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\DumpReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SomSoftMgrdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtwebbrowser.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360ZMUDetail.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtfilm.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\PDown.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\LiveUpdate360.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\AppcenterDataGb.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\LiveUpdate360.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBoxCore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtfilm.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\AppCenterCore.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Common.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\360P2SP.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360weibo.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360wapp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\ExtNetIncrement.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\oauthlogin.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{786DF1B6-83F7-43fe-8CAF-75FCED58443B}.tmp\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\AppUpdate.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\desktoptool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\360weibo.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360dtpreview.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\DTQuickInstProxy.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\NotifyDown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTQuickInstProxy.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\MsgBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somcoredt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GameBox.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtwebbrowser.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBox.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SoftMgrLiteBase.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtswitcher64.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\CatchScreenTray.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTFence.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\360GbApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\safemon\urlprocnet.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\AppcenterDataGb.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\LiveUpd360.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\DumpReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Uninstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\BoxUI.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopSwitch.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Shell360dt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\modules\360Inst.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTNotify.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somQuickInstdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\ExtNetIncrement.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtappcore.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\sqlite3.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\RegularShutdown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GbApp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtwebframe.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher64.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360P2SP.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360Ver.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360net.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\MusicIEFrame.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360FeedBack.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\desktoptool.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\SetupUtilDT.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\BizPluginCake.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360net.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\img_reader.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.rsJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\CloudTaskCenter_naive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\AppcenterData.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtappcore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360AppCore.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\CatchScreenTray.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\img_reader.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somkernldt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\360Inst.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UpdateTool.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\360GameBox.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppCenterCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.rs (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Ver.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppUpdate.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GameBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Apns.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeEvaded block: after key decision
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleep
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_10-17268
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleep
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_16-11671
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_16-11286
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeAPI coverage: 4.0 %
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe TID: 1304Thread sleep count: 40 > 30
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: PhysicalDrive0Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile Volume queried: C:\ FullSizeInformation
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,16_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00405D3A FindFirstFileA,FindClose,16_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00402630 FindFirstFileA,16_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,17_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_00405D3A FindFirstFileA,FindClose,17_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_00402630 FindFirstFileA,17_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C89EF80 _memset,_memset,PathAddBackslashW,FindFirstFileW,_memset,PathAddBackslashW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,19_2_6C89EF80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C74BF00 PathFindFileNameW,OpenProcess,_memset,GetModuleFileNameExW,K32GetModuleFileNameExW,GetProcessImageFileNameW,_memset,GetLogicalDriveStringsW,QueryDosDeviceW,_memset,_memset,_wcschr,GetLongPathNameW,_wcsncpy,FindCloseChangeNotification,21_2_6C74BF00
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppDataJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QemuManager.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "Qemu Manager 6.0\Qemu Manager.lnk
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1923918855.0000000001474000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8
      Source: explorer.exe, 00000018.00000000.2202592501.0000000009330000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}F
      Source: GBInst.exe, 00000010.00000003.2137176515.0000000000513000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmware.exe
      Source: GBInst.exe, 00000010.00000003.2138893350.0000000000513000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1M735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: explorer.exe, 00000018.00000002.2251608857.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00=
      Source: explorer.exe, 00000018.00000000.2202592501.0000000009255000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Qemu Manager 6.0\Qemu Manager.lnk
      Source: explorer.exe, 00000018.00000002.2259478320.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.00000000090DA000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: GSoftware\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Workstation
      Source: GBInst.exe, 00000010.00000002.2190699098.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000003.2149470826.000000000051E000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000003.2141250973.000000000051A000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000003.2149513732.000000000051F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
      Source: explorer.exe, 0000001A.00000003.2280017915.0000000004201000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: E#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: 360TopbarASS.exe, 0000000A.00000002.2080970323.000000000083E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllyy
      Source: explorer.exe, 00000018.00000000.2202592501.000000000928B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
      Source: explorer.exe, 00000018.00000002.2259478320.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.00000000090DA000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en\volume.inf_loc
      Source: 360TopBar.exe, 00000015.00000002.2280681135.00000000013EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk>Ui
      Source: explorer.exe, 00000018.00000002.2251608857.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: BSoftware\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Player
      Source: explorer.exe, 00000018.00000000.2202592501.000000000928B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware\VMware Workstation.lnk
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware\VMware Player.lnk
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Software\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Workstation
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Software\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Player
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU Manager
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Player
      Source: explorer.exe, 00000018.00000002.2251608857.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Workstation
      Source: explorer.exe, 00000018.00000000.2202592501.0000000009330000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
      Source: explorer.exe, 00000018.00000002.2251608857.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeAPI call chain: ExitProcess graph end nodegraph_16-10916
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeAPI call chain: ExitProcess graph end nodegraph_16-11673
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeAPI call chain: ExitProcess graph end nodegraph_17-10397
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeAPI call chain: ExitProcess graph end nodegraph_17-11200
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeAPI call chain: ExitProcess graph end node
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeAPI call chain: ExitProcess graph end node
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeAPI call chain: ExitProcess graph end node
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeAPI call chain: ExitProcess graph end node
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Windows\explorer.exeProcess queried: DebugPort
      Source: C:\Windows\explorer.exeProcess queried: DebugPort
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B711FB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00B711FB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C926530 GetCurrentThreadId,OpenThread,GetProcessHeap,OpenThread,GetLastError,GetProcessHeap,HeapFree,OutputDebugStringW,CloseHandle,19_2_6C926530
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B8023C LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,10_2_00B8023C
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B84593 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,10_2_00B84593
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B711FB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00B711FB
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7294A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00B7294A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B6EBA1 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00B6EBA1
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B70D52 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00B70D52
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7BEE8 SetUnhandledExceptionFilter,10_2_00B7BEE8
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0379579A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_0379579A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_037965B2 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_037965B2
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_0379CD95 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_0379CD95
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F2965D SetUnhandledExceptionFilter,17_2_02F2965D
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 17_2_02F2964B SetUnhandledExceptionFilter,17_2_02F2964B
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CB1970 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,19_2_00CB1970
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CBC2F2 SetUnhandledExceptionFilter,19_2_00CBC2F2
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CB1318 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,19_2_00CB1318
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_00CB46DB __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,19_2_00CB46DB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C90CC8B __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,19_2_6C90CC8B
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C908D36 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,19_2_6C908D36
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 19_2_6C908660 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,19_2_6C908660
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_00561C00 lstrlenW,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,Sleep,CreateMutexW,GetLastError,SetUnhandledExceptionFilter,__set_invalid_parameter_handler,21_2_00561C00
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_0056997E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_0056997E
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_00569241 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_00569241
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_00573F44 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,21_2_00573F44
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_0056E715 SetUnhandledExceptionFilter,21_2_0056E715
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C762B5A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,21_2_6C762B5A
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C7584BD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_6C7584BD
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_6C758537 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_6C758537
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle, explorer.exe21_2_00561160
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle, explorer.exe21_2_00561160
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle, explorer.exe21_2_00561160
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: __wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle, explorer.exe21_2_00561209
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" Jump to behavior
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe "C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 21_2_00561720 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,21_2_00561720
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /AddApp=%dProgmanWorkerW360DesktopFullScreenWndClass360DockBarCtrl\RegSMWebProxy.exe\360Desktopwait_for_fullscreen_show
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ANtCreateUserProcessntdll.dllNtCreateProcessExAppCenterData.dllCreateAppCenterIPCMgrC:*.*.."%s" %sProgmanSHELLDLL_DefViewWorkerWdt_webapp_browser_.lnkExplorerRunFiles (x86)%s\360gameusers%s\360Desktop%s\360desktop.ini%s\360GBsc.ini%s\360Dtsc.ini%s\Skin%s\MiniAppdata.xdb%s\UpgradeData.xdb%s\Config.ini%s\webapps.ini%s\Config.Xdb%s\Config.nxdb%s\HandlerDelFlag.ini%s\SoftMgr.db%s\SoftMgrCfg.db%s\DtUpdateConfig.ini%s\AppDataStorage.db%s\updateapptips.ini%s\SCDUP%s\import.fg%s\AppSCProc.ini#RELATIVE_PATH#%s\360Desktop\Image\Icon\Common\%s\InnerWeb\%s\clientsoftIDs.tmp%s\pushrecord.ini%s\w360_Weather.ini%s\Temp\%s\AdvMsg.xml%s\DtWebMailHost.nxdb%s\AdvMsgRecord.ini%s\schedule.ini%s\ChildeMode\%s\PswImg%s\DisneyMode\%s\Sound%s\360GameCenter.exe360GameBox.exe360GbApp.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628181945.0000000004088000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628668213.00000000046A8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Shell_traywndP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E225000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.0000000007787000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: http://zhuomian.360.cn/ver2.0Shell_TrayWnd\Welcome UiFeatureUiFeatureWindowUI_FEATURE_%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02Xfeaturewindowparaminvalid map/set<T> iteratormap/set<T> too long
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndXMenuDragREBAR_GRIPStatusBarFFindBarFTabBarFPlugInBarFMiniBarFFavoriteBarFMenuBarFSearchBarFTabBarPlugInBarMiniBarMenuBarSearchBarStyleSideBarCurSelComboBoxBG_ADDRESSAdressLeftPadAdressRightPadBG_ADDRESSEDITAddressCYAddressBarMainCYBottomCornerMultiTabBrowser-Embedding%s:%sGlobalUserOfflineSoftware\Microsoft\Windows\CurrentVersion\Internet Settingshttp://www.ioage.com/cn/help-appendix-04.htmhttp://www.theworld.cn/http://www.ioage.com/cn/help.htmTWFORM.HTMStatusPluginKeyhttp://www.ioage.com/cn/guide/guide_start.htmhttp://www.ioage.com/wzhttp://bbs.ioage.comhtm400%200%150%130%50%70%30%%s&guid=%s&lastver=%s2.1.2.22.1.2.42.1.0.22.0.5.12.0.3.42.3.0.72.3.0.8Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN2.2.1.02.2.1.22.2.1.4ICON_ADD_FAVORITEStatusCYXFrame_Wnd-setupopenNAVIERR.HTM125%TheWorld.icotw:confhttp://www.google.com.hk/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=%s&ie=utf-8http://www.google.com.hk/search?q=&tn=ichunertn=baidu.com/baidu?baidu.com/shttps:http:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2158601528.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanSHELLDLL_DefViewWorkerWWinsta0\default" AdvApi32CreateProcessWithTokenWexplorer.exe360GameBox.exe360GbApp.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exe..\Uninstall.exe/SopenBin\360Desktop.exe..\360gamebox.exe/INSTALL/UNINSTALL/UNINSTFromSP/LowRunDeskTop/LowRunGameBox/ClearGBAppZip/SetLocalTime_vector<T> too longsomkernldt.dll..\somkernl.dllSomPluginbad allocation~{
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: JvR0kFstd::stringSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exeAppcenterData.dllCreateAppCenterDataInterface.fbak\MiniAppdata.xdb-journal%%%ProgMan..\360appcenter.exe-from 360desktop_new -startup 360loopwallpaper.exeWallPaper\wallpaper.swf WallPaper\wallpaper_cm.swf HideSuspWndUtil::APP::RunFlashApp() -enDesktopMode=%d -pszSwfPath=%sright_menu_wallpaper-swf "%s" -new %d -ver %d -from 360desktop_new -startup flashapp.exe%s StartByDesktopGloUtil::GetDownloadMgr()->CallFlashApp() -bRet=%dWALLPAPER\WALLPAPAER_NEW_TOTALCOUNTWALLPAPER\WALLPAPER_NOW_TOTALCOUNT%s%d\360kantu.exe360safe.exe360chrome.exe360se.exeabout:blank\SoftMgr\SoftManager.exehttp://www.360.cnMAINFRAME\HWND360Desktop\first_run_flag
      Source: explorer.exe, 00000018.00000000.2195779388.0000000001091000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: 0Program Manager
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ech.txtShell_TrayWndReBarWindow32pastelinkpaste360desktop DropEffectcopycut%s\%s - oR,g%s%s\%s - oR,g (%d)%s360DestopNetDiskClipBoardKeyskin\deskmirror.uizDrawShadowTextLastResulotionycomctl32.dllx
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA9D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ccsUTF-8UTF-16LEUNICODEe+0001#QNAN1#INF1#IND1#SNAN\Fonts\msyh.ttfWorkerWProgmanSHELLDLL_DefView360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32_360DesktopSwitcherControlWnd_MsgOnly__360DesktopSwitcherControlWnd_MsgOnly_Wnd360DirectUICls_SwitchBar360DirectUICls360Desktop\ExecuteProFile.tmpfilepathexecuteparams
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IcustomUrl360Desktop\Image\Icon\Common\customUrl.png360Desktop\Image\Icon\Common\customUrl_64.png360Desktop\Image\Icon\Common\customUrl_72.pngdefAppIcon360Desktop\Image\Icon\Common\Default_48.png360Desktop\Image\Icon\Common\Default_64.png360Desktop\Image\Icon\Common\Default_72.pngappMask360Desktop\Image\Icon\Common\DefaultMask_48.png360Desktop\Image\Icon\Common\DefaultMask_64.png360Desktop\Image\Icon\Common\DefaultMask_72.png\UserChoice\ProgidHKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\HKCU\Software\Classes\HKCR\\shell\\command\httpSoftware\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE.lnk..\AppSCProc.iniExplorerRunFilesWorkerWSHELLDLL_DefViewFolderViewProgmanInternet Explorer_ServerGetNativeSystemInfo360DesktopSwitch64.exe360DesktopSwitch.exe"%s" %s360Desktop\ExecuteProFile.tmpfilepathexecuteparamsh
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C873000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Anametext360Desktop\Xml\Tools\DesktopToolAppCenterData.dllCreateAppCenterIPCMgrC:*.*..HibernateEnabledSYSTEM\CurrentControlSet\Control\PowerHeuristicsSYSTEM\CurrentControlSet\Control\Session Manager\Powerpowercfg.exe-h on-h off"%s" %s?dir?RES.exe.ICO.imeProgmanWorkerWHARDWARE\DESCRIPTION\System\CentralProcessor\0~MHzAMD4
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A..\C:/.dllProgmanWorkerWSeDebugPrivilegeListBkListSelBkDropBtnITEMcmdIdselectedImagesrcColorvalueBG_blockBG_imgBtn_blockBtn_imgBtn_heightTabBtnmsctls_hotkey32t
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BA37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Fidinfoexec..params.lnk..\AppSCProc.iniExplorerRunFilesWorkerWSHELLDLL_DefViewFolderViewSysListView32ProgmanInternet Explorer_ServerGetNativeSystemInfokernel32.dll360DesktopSwitch64.exe360DesktopSwitch.exe"%s" %s360Desktop\ExecuteProFile.tmpfilepathexecute=at /t %s /w %scid /C %sins /d "%s"acc /id %spa /p %sopent\config.iniimagetextmidJumpToLoginUrl("%s");__login__logout@*Wp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WorkerWProgmanSHELLDLL_DefViewFolderViewSysListView32skin\images\topbar%s %s360Desktop.exe/fromtopbar /entertainment/fromtopbar /fence360DesktopFullScreenWndClassPathSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe\360wpsrv.exe\360wpapp.exeStartByDesktop StartFrom=4360WallPaperCtrlCls/pid=360zhuomian..\360yunpan\360WangPan.exe360AppCore.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exeSoftMgr\360AppCore.exe360desktop_appcore"%s"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe\Bin\AppCenterData.dllCreateAppCenterIPCMgr/fromtopbar /opensetting/fromtopbar /checkupdateURL="%s"explorer.exe\..\360Desktop.exe%d.%d.%d.%d/fromtopbar %s360Lhb
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AWorkerWProgman360DesktopFullScreenWndClass360DirectUICls360DirectUICls_SwitchBarSOFTWARE\360Desktop\safemon360Preview840F77CA-2872-4366-B665-ED3F37205588GetMiniUIMiniUI.dllCreate360FireWareStateFunction2GetFireWallStateCreate360FireWareStateFunctionGet360ProductHistoryManagerGet360CommonInstance360Common.dll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndSV
      Source: explorer.exe, 00000018.00000002.2259478320.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256289073.00000000044D0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
      Source: 360TopBar.exe, explorer.exe, 00000018.00000000.2195306682.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2251608857.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2195779388.0000000001091000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunCONOUT$SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecDllRegisterServer360DesktopFullScreenWndClassWorkerWProgmanparam.iniparaminfo/sharewallpaperSMWebProxydt.dll/i /s "%s"Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{70425897-213B-4a9a-943B-2EEFB2124E35}\iexploreFlagsSoftware\Microsoft\Windows\CurrentVersion\Ext\Stats\{70425897-213B-4a9a-943B-2EEFB2124E35}\iexplore\AllowedDomainsSoftware\Microsoft\Windows\CurrentVersion\Ext\Stats\{70425897-213B-4a9a-943B-2EEFB2124E35}\iexplore\AllowedDomains\*Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70425897-213B-4a9a-943B-2EEFB2124E35}\360Notify\BinAppPath360seNotify.exeAppNamePolicySoftware\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70425897-213B-4a9a-943B-2EEFB2124E36}360Desktop.exeSoftware\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70425897-213B-4a9a-943B-2EEFB2124E37}RegSMWebProxy.exeShareWallPaper360DockBarCtrl360DesktopMainWndForMsgwait_for_fullscreen_show360
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunGetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLLSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$TaskbarCreatedGetNativeSystemInfokernel32.dll360DesktopSwitch64.exe"%s" %sSHELLDLL_DefViewWorkerWProgman360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32StopInExplorerdtswitcher64.dlldtswitcher.dllStartInExplorer/desktopwnd=/unloaddtswitcherdtunloader64.dlldtunloader.dllUnLoadDtSwitchModule/undock/lockscreen/levelscreenSingle360DesktopSwitchMutex
      Source: explorer.exe, 0000001A.00000003.2274913938.0000000004255000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2268532283.0000000004255000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2284366760.0000000004255000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndsOJ
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B768000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunGetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLLSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$TaskbarCreatedGetNativeSystemInfokernel32.dllSHELLDLL_DefViewWorkerWProgman360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32StopInExplorerdtswitcher64.dlldtswitcher.dllStartInExplorer/desktopwnd=/unloaddtswitcherdtunloader64.dlldtunloader.dllUnLoadDtSwitchModule/undock/lockscreen/levelscreenSingle360DesktopSwitchMutexx
      Source: 360TopBar.exe, 00000015.00000002.2316212434.000000006C76F000.00000002.00000001.01000000.0000001F.sdmpBinary or memory string: tlWorkerWProgmanSHELLDLL_DefViewFolderViewSysListView32skin\images\topbar%s %s360Desktop.exe/fromtopbar /entertainment/fromtopbar /fence360DesktopFullScreenWndClassPathSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe\360wpsrv.exe\360wpapp.exeStartByDesktop StartFrom=4360WallPaperCtrlCls/pid=360zhuomian..\360yunpan\360WangPan.exe360AppCore.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exeSoftMgr\360AppCore.exe360desktop_appcore"%s"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe\Bin\AppCenterData.dllCreateAppCenterIPCMgr/fromtopbar /opensetting/fromtopbar /checkupdateURL="%s"explorer.exe\..\360Desktop.exe%d.%d.%d.%d/fromtopbar %s360Lhb
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Aidinfoopenexec..params.lnk..\AppSCProc.iniExplorerRunFilesWorkerWSHELLDLL_DefViewFolderViewSysListView32ProgmanInternet Explorer_ServerGetNativeSystemInfokernel32.dll360DesktopSwitch64.exe360DesktopSwitch.exe"%s" %s360Desktop\ExecuteProFile.tmpfilepathexecute|=at /t %s /w %scid /C %sins /d "%s"acc /id %spa /p %st\config.iniSoftMgr\360AppCore.exe360AppCore.exedtappcore.dll360desktop_appcore360dt_ipc_dwmem_name,
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %s\%u_%sNONeedCopySCNOForbidSCShell_TrayWndReBarWindow32360Desktop.exe Push SysListView Window success, %d %d %d %d
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QueryFullProcessImageNameWKernel32.dll.jfif.jpe.jpeg.jpghideSkintrayTipsDISPLAYWorkerWProgman360DirectUICls360DirectUICls_SwitchBarSHELLDLL_DefViewSysListView32FolderViewTipsLastActiveDaybActived360WallpaperMsgWndClass@360DesktopFullScreenWndClasstooltips_class32
      Source: explorer.exe, 00000018.00000000.2195779388.0000000001091000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {:g{21EC2020-3AEA-1069-A2DD-08002B30309D}{208D2C60-3AEA-1069-A2D7-08002B30309D}{450D8FBA-AD25-11D0-98A8-0800361B1103}{871C5380-42A0-1069-A2EA-08002B30309D}{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}{645FF040-5081-101B-9F08-00AA002F954E}{59031a47-3f72-44a7-89c5-5595fe6b30ee}{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}{20D04FE0-3AEA-1069-A2D8-08002B30309D}Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenuSoftware\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanelDefaultIconSoftware\Microsoft\Windows\CurrentVersion\Explorer\CLSID%s\%s\%sSoftware\Microsoft\Windows\CurrentVersion\ThemesSoftware\Microsoft\Windows\CurrentVersion\ThemeManagerProgram Manager
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanWorkerW360DTFence
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DA44000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: GAIsProcessorFeaturePresentKERNEL321#QNAN1#INF1#IND1#SNAN\Fonts\msyh.ttfWorkerWProgmanSHELLDLL_DefView360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32_360DesktopSwitcherControlWnd_MsgOnly__360DesktopSwitcherControlWnd_MsgOnly_Wnd360DirectUICls_SwitchBar360DirectUICls360Desktop\ExecuteProFile.tmpfilepathexecuteparams
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D3C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: popupmsgtypesubtypepopuppospopupcontentmsgflagitemidpubtimeapp_idcontent_htmlnotify_typeopen_urlico_urlbutton_textmsgflagrealtimeapp_msg_tips_enableapp_msg_tips_pos_xapp_msg_tips_pos_yWorkerWSHELLDLL_DefViewFolderViewSysListView32Progmandurl=360DesktopChildrenWndClass360DesktopModeWndClass360DesktopDisneyWndClass360DesktopFullScreenWndClasstaskmgr.exeexplorer.exeKernel32.dllQueryFullProcessImageNameW\\.\360SelfProtection360WebIdentify.dllGetWebIdentifyStatePath\netmon360DesktopNewFreshmanWndSingleClass{96FBB367-DA91-4583-B77E-51610A64F02C}true360AppCoreAppCore_IsGameModed
      Source: explorer.exe, 00000018.00000002.2259478320.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2202592501.000000000936E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd]1Q
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B6FBF0 cpuid 10_2_00B6FBF0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,10_2_00B7D8D7
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,10_2_00B828DE
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,10_2_00B7D83F
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,10_2_00B7D07C
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,10_2_00B82912
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,10_2_00B7D94B
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,10_2_00B7D2D4
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,10_2_00B7CA0E
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,10_2_00B82A51
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,10_2_00B7DBDE
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,10_2_00B7DB1D
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,10_2_00B754BB
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,10_2_00B7DC81
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,10_2_00B8443A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,10_2_00B7B425
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,10_2_00B7DC45
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,10_2_00B7F730
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,10_2_00B73F26
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,GetLocaleInfoA,GetACP,10_2_00B7D728
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: GetLocaleInfoA,16_2_0379C604
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,19_2_00CBDE87
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,19_2_6C91CCBF
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,GetLocaleInfoA,GetACP,19_2_6C91AEF5
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,19_2_6C91A84C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,19_2_6C91AAA4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,19_2_6C91EB2B
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,19_2_6C91A1DE
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,19_2_6C90E24A
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,19_2_6C9103A4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,19_2_6C91B412
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,19_2_6C91B44E
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,19_2_6C91B0A4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,19_2_6C91B00C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,19_2_6C91D1EC
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,19_2_6C91B118
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,19_2_6C91B2EA
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA,19_2_6C91D220
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,19_2_6C91B3AB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,19_2_6C91D35F
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: GetLocaleInfoA,21_2_00574505
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: GetLocaleInfoA,21_2_6C7666AA
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_hover.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_press.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\tab_select.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\focus_rect.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_shutdown_button.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_wallpaper_button.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_fence_button.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 10_2_00B7C676 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,10_2_00B7C676
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 16_2_00405A65 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,16_2_00405A65
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avcenter.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: reanimator.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\avgtray.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\kasmain.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: spideragent.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: http://down.360safe.com/setup.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: 360TopBar.exeBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avgui.exe
      Source: 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2154054897.0000000003581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2273591960.0000000001244000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000003.2254540511.0000000001384000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Y\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 123.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bdagent.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avp.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\avgui.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DFA8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: >`SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmp, flashApp.exeBinary or memory string: 360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wireshark.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: zlclient.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\wireshark.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kasmain.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fsb.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Unhackme.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: spf.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avgtray.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe%d.%d.%d.%d\5SoftMgr\SoftManager.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bin\ClamWin.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ClamWin.exe

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
      Valid Accounts3
      Native API      		1
      DLL Side-Loading      		1
      DLL Side-Loading      		1
      Deobfuscate/Decode Files or Information      		OS Credential Dumping1
      System Time Discovery      		Remote Services11
      Archive Collected Data      		Exfiltration Over Other Network Medium3
      Ingress Tool Transfer      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without Authorization1
      Data Encrypted for Impact      		Acquire InfrastructureGather Victim Identity Information
      Default Accounts2
      Command and Scripting Interpreter      		2
      DLL Search Order Hijacking      		2
      DLL Search Order Hijacking      		2
      Obfuscated Files or Information      		LSASS Memory5
      File and Directory Discovery      		Remote Desktop Protocol1
      Screen Capture      		Exfiltration Over Bluetooth2
      Encrypted Channel      		SIM Card SwapObtain Device Cloud Backups1
      System Shutdown/Reboot      		DomainsCredentials
      Domain AccountsAt1
      Registry Run Keys / Startup Folder      		22
      Process Injection      		1
      DLL Side-Loading      		Security Account Manager45
      System Information Discovery      		SMB/Windows Admin Shares1
      Clipboard Data      		Automated Exfiltration3
      Non-Application Layer Protocol      		Data Encrypted for ImpactDNS ServerEmail Addresses
      Local AccountsCron1
      Bootkit      		1
      Registry Run Keys / Startup Folder      		2
      DLL Search Order Hijacking      		NTDS1
      Query Registry      		Distributed Component Object ModelInput CaptureTraffic Duplication13
      Application Layer Protocol      		Data DestructionVirtual Private ServerEmployee Names
      Cloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
      Masquerading      		LSA Secrets371
      Security Software Discovery      		SSHKeyloggingScheduled TransferFallback ChannelsData Encrypted for ImpactServerGather Victim Network Information
      Replication Through Removable MediaScheduled TaskRC ScriptsRC Scripts14
      Virtualization/Sandbox Evasion      		Cached Domain Credentials14
      Virtualization/Sandbox Evasion      		VNCGUI Input CaptureData Transfer Size LimitsMultiband CommunicationService StopBotnetDomain Properties
      External Remote ServicesSystemd TimersStartup ItemsStartup Items22
      Process Injection      		DCSync3
      Process Discovery      		Windows Remote ManagementWeb Portal CaptureExfiltration Over C2 ChannelCommonly Used PortInhibit System RecoveryWeb ServicesDNS
      Drive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
      Regsvr32      		Proc Filesystem11
      Application Window Discovery      		Cloud ServicesCredential API HookingExfiltration Over Alternative ProtocolApplication Layer ProtocolDefacementServerlessNetwork Trust Dependencies
      Exploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
      Bootkit      		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedExfiltration Over Symmetric Encrypted Non-C2 ProtocolWeb ProtocolsInternal DefacementMalvertisingNetwork Topology

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1367834 Sample: SecuriteInfo.com.Trojan.Cli... Startdate: 29/12/2023 Architecture: WINDOWS Score: 51 69 wallpaper.apc.360.cn.wscdns.com 2->69 71 wallpaper.apc.360.cn 2->71 73 11 other IPs or domains 2->73 87 Yara detected AntiVM3 2->87 89 Contains functionality to infect the boot sector 2->89 8 SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe 2 657 2->8         started        13 explorer.exe 2->13         started        15 explorer.exe 2->15         started        17 2 other processes 2->17 signatures3 process4 dnsIp5 75 171.8.167.89, 49722, 49730, 49764 CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR China 8->75 77 s.360.cn 171.13.14.66, 49710, 80 CHINANET-BACKBONENo31Jin-rongStreetCN China 8->77 61 C:\Users\user\AppData\Roaming\...\sqlite3.dll, PE32 8->61 dropped 63 C:\Users\user\...xtNetIncrement.dll (copy), PE32 8->63 dropped 65 C:\Users\user\AppData\...\360weibo.exe (copy), PE32 8->65 dropped 67 162 other files (none is malicious) 8->67 dropped 95 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->95 19 GBInst.exe 8->19         started        22 regsvr32.exe 8->22         started        24 360DesktopSwitch64.exe 8->24         started        34 11 other processes 8->34 97 Query firmware table information (likely to detect VMs) 13->97 27 WerFault.exe 13->27         started        29 360wpsrv.exe 17->29         started        32 WerFault.exe 17->32         started        file6 signatures7 process8 dnsIp9 45 C:\Users\user\AppData\Local\...\registry.dll, PE32 19->45 dropped 47 C:\Users\user\AppData\Local\...\System.dll, PE32 19->47 dropped 49 C:\Users\user\AppData\...\SetupHelperGB.dll, PE32 19->49 dropped 57 25 other files (none is malicious) 19->57 dropped 36 regsvr32.exe 22->36         started        93 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 24->93 79 d2aydouiit1aqm.cloudfront.net 18.160.172.19, 49734, 80 MIT-GATEWAYSUS United States 29->79 81 18.161.170.106, 49735, 80 MIT-GATEWAYSUS United States 29->81 85 2 other IPs or domains 29->85 39 360wpapp.exe 29->39         started        41 360wpapp.exe 29->41         started        83 101.198.2.147, 49721, 49723, 49765 QIHOOBeijingQihuTechnologyCompanyLimitedCN China 34->83 51 C:\Users\user\AppData\...\Uninstall.exe, PE32 34->51 dropped 53 C:\Users\user\AppData\...53otifyDown.dll, PE32 34->53 dropped 55 C:\Users\user\AppData\...\DTCrashReport.exe, PE32 34->55 dropped 59 8 other files (none is malicious) 34->59 dropped 43 regsvr32.exe 34->43         started        file10 signatures11 process12 signatures13 91 Creates an undocumented autostart registry key 36->91

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe4%ReversingLabs
      SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe1%VirustotalBrowse

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)1%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\360Ver.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)3%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\360net.dll (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\360net.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\360verify.dll (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\360verify.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\7z.dll0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\7z.dll0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)2%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DTSwitchBar.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)2%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe (copy)3%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe (copy)1%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)2%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)0%VirustotalBrowse
      C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)1%VirustotalBrowse

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      SourceDetectionScannerLabelLink
      res.qhupdate.com0%VirustotalBrowse
      static.apc.360.cn.lxdns.com0%VirustotalBrowse
      wallpaper.apc.360.cn.wscdns.com0%VirustotalBrowse
      p1.qhimg.com0%VirustotalBrowse
      p8.qhimg.com1%VirustotalBrowse

      URLs

      SourceDetectionScannerLabelLink
      https://powerpoint.office.comer0%URL Reputationsafe
      http://www.indyproject.org/0%URL Reputationsafe
      http://%s/api.php?0%Avira URL Cloudsafe
      http://127.0.0.1/%sfilename=resourcesfilesmetalink:/0%Avira URL Cloudsafe
      http://res.qhupdate.com/wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini%d.%dB:A:downloadpat0%Avira URL Cloudsafe
      http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.png0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/friendships/show.xml0%Avira URL Cloudsafe
      http://p17.qhimg.com/t01786e375a7830d753.png0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/0%Avira URL Cloudsafe
      http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.png0%VirustotalBrowse
      http://www.meilishuo.com/users/register0%Avira URL Cloudsafe
      http://%s/intf.php?0%Avira URL Cloudsafe
      http://127.0.0.1/%sfilename=resourcesfilesmetalink:/0%VirustotalBrowse
      http://login.sina.com.cn/member/getpwd/getpwd0.php?entry=ssoS0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/0%VirustotalBrowse
      http://p17.qhimg.com/t01786e375a7830d753.png0%VirustotalBrowse
      http://api.t.sina.com.cn/friendships/create/%s.json?source=%s0%Avira URL Cloudsafe
      http://www.meilishuo.com/users/register0%VirustotalBrowse
      http://api.t.sina.com.cn/friendships/create.xml0%Avira URL Cloudsafe
      http://desk.score.svc.1360.com/get?qid=%s&sign=%sLoginBallShowCountLoginGuideShowLLoginGuideShowHGui0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/friendships/create/%s.json?source=%s0%VirustotalBrowse
      http://www.ifeng.com&fromweb=other&AutoPlay=false0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/account/verify_credentials.xml?source=U0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/friendships/create.xml0%VirustotalBrowse
      http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.png0%Avira URL Cloudsafe
      http://zhifu.openapi.360.cnMode0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/friendships/show.xml0%VirustotalBrowse
      http://api.t.sina.com.cn/statuses/update.xml0%Avira URL Cloudsafe
      http://www.360.cn;color=rgb(600%Avira URL Cloudsafe
      http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.png0%VirustotalBrowse
      http://api.t.sina.com.cn/statuses/update.xml0%VirustotalBrowse
      http://api.t.sina.com.cn/account/verify_credentials.xml?source=U0%VirustotalBrowse

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      d2aydouiit1aqm.cloudfront.net
      		18.160.172.19
      		truefalse
        		high
        res.qhupdate.com
        		1.192.137.108
        		truefalseunknown
        static.apc.360.cn.lxdns.com
        		138.113.29.74
        		truefalseunknown
        wallpaper.apc.360.cn.wscdns.com
        		138.113.29.74
        		truefalseunknown
        s.360.cn
        		171.13.14.66
        		truefalse
          		high
          stat.apc.360safe.com
          		unknown
          		unknownfalse
            		high
            p1.qhimg.com
            		unknown
            		unknownfalseunknown
            static.apc.360.cn
            		unknown
            		unknownfalse
              		high
              p8.qhimg.com
              		unknown
              		unknownfalseunknown
              stat.apc.360.cn
              		unknown
              		unknownfalse
                		high
                relate.apc.360.cn
                		unknown
                		unknownfalse
                  		high
                  wallpaper.apc.360.cn
                  		unknown
                  		unknownfalse
                    		high
                    api.msn.com
                    		unknown
                    		unknownfalse
                      		high

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32713&r3=1280x1024false
                        		high
                        http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=10047false
                          		high
                          http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192false
                            		high

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            https://powerpoint.office.comerexplorer.exe, 00000018.00000002.2266357108.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://tp3.sinaimg.cn/1751401422/50/5611920854/1SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://s.360.cn/bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://stat.apc.360.cn/msg.html?type=open&action=runmsg&from=full&detail=run&open_msgbox360IDSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/58/mb_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://static.apc.360.cn/cms/wallpaper_feedback.htmlloopwallpaper.xml&r1=1&action=bizhiEntrance&from360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://static.apc.360.cn/cms/theme/index.htmlMusicIEFrame7SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.ioage.com/web/frame_naverror.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/60/horse2_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • 0%, Virustotal, Browse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000018.00000000.2202592501.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://connect.360.cn/index.php?USecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://wan.360.cn/bbs.htmlgame.360.cn&name=http://wan.360.cn/bbs/second.html?g=%shttp://wan.360.cnnSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://pstat.p.360.cn/uplog.php0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D4ED000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2119564309.0000000003581000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://127.0.0.1/%sfilename=resourcesfilesmetalink:/SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • 0%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://weibo.comSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.indyproject.org/SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://%s/api.php?flashApp.exefalse
                                                      • Avira URL Cloud: safe
                                                      		low
                                                      http://api.t.sina.com.cn/friendships/show.xmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • 0%, Virustotal, Browse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/0c/ws_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://res.qhupdate.com/wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini%d.%dB:A:downloadpat360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&verSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1874170082.0000000003EF8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://p17.qhimg.com/t01786e375a7830d753.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • 0%, Virustotal, Browse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://api.t.sina.com.cn/SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • 0%, Virustotal, Browse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=1SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://bbs.360.cn/5473920.htmlCPictureGridPicker::ScrollTo:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=2SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D18C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://dapp.wan.360.cn/360desk/mhxx?scrol=no&height=&r=1328833800DSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D683000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/8b/sleepy.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/33/camera_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d9/ye_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://stat.apc.360.cn/stat.html?type=new&amp;action=newdetailclick&amp;from=1000&amp;uid=1&amp;pid=SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://api.weibo.com/2/friendships/show.jsonSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://static.apc.360.cn/cms/mini/investment.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://stat.apc.360.cn/stat.html?type=open&action=bengkuilesorry&deskbanben=%s&deakbanhao=%s&t=%dMoz360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://s.360.cn/bizhi/s.html?action=bizhibox&from=2360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.ioage.com/hl/cn/rendermode.htmSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://img.360.cn/images/webapp/logo1223/menuyouxi.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://android.notify.windows.com/iOSdexplorer.exe, 00000018.00000002.2266357108.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.2208854440.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://my.360.comSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://client.apc.360.cn/cms/360dtconf.inidSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://s.360.cn/dt/s.htm?pid=%s&fun=%s&act=%d&res=%d&mid=%s&ver=%s&r1=%d&r2=%dSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.meilishuo.com/users/registerSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D8A9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • 0%, Virustotal, Browse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://%s/intf.php?flashApp.exefalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		low
                                                                                              http://seapp.stat.360safe.com/ver.html?name=%s&p=%s&mid=%s&fa=%s&fb=%s&fc=%sUSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://login.sina.com.cn/member/getpwd/getpwd0.php?entry=ssoSSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://spreadsheets.google.com/http://spreadsheets.google.com/https://docs.google.com/http://docs.gSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://api.t.sina.com.cn/friendships/create/%s.json?source=%sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D27E000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmp, flashApp.exe, 00000013.00000003.2135145181.0000000002620000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  • 0%, Virustotal, Browse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://www.360.cn/ucenter/faq.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D5B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://intf.zsall.mobilem.360.cn/zsintf/getDownloadUrl?soft_ids=%s&market_id=&appver=%s&uid=%s&pid=%SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://s.360.cn/xiaoguanjia/xgj.html%s?action=shutdown&from=%d&appver=SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://bbs.ioage.com/cn/forum-33-1.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/1b/m_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7e/hei_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://api.t.sina.com.cn/friendships/create.xmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • 0%, Virustotal, Browse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&veSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2273079673.0000000003E94000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://stat.apc.360.cn/stat.html?type=new&action=SetAppwallpaper&from=1&fangshi=&appid=&r1=&r2=&r3=&SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://desk.score.svc.1360.com/get?qid=%s&sign=%sLoginBallShowCountLoginGuideShowLLoginGuideShowHGuiSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  http://www.theworld.cn/client/syncfavsorder.db%sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://static.apc.360.cn/cms/video/shipinhezi1.html%sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f3/k_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://s.360.cn/bizhi/s.html?action=bizhiset&from=0&appver=2.1.0.1026&pid=zhuomian&m=360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://swf.baoku.360.cn/zhuomian/player/v2/douban.zipSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007039000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://www.winimage.com/zLibDll-1.2.3rbrSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://wallpaper.apc.360.cn360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002A04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c7/no_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://bizhi.360.cn/#360360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://api.t.sina.com.cn/account/verify_credentials.xml?source=USecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    • 0%, Virustotal, Browse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.ifeng.com&fromweb=other&AutoPlay=falseSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		low
                                                                                                                                    http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007908000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1891511089.0000000007A1F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000002.2191935787.0000000002717000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    • 0%, Virustotal, Browse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=&count=16&show=1&version=catecidrelaSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 0000000A.00000000.2072888648.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://stat.apc.360.cn/stat.html?type=open&action=anzhuangyunxing&from=%d&appver=%s&packagever=%s&uiSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621846133.0000000000C5B000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBAexplorer.exe, 00000018.00000000.2198948294.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2256560379.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2275784860.000000000429F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2348494840.000000000429F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dyingyongdianjihttp://stat.apc.360safe.cSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://zhuomian.360.cn/ver2.0SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D0CD000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exefalse
                                                                                                                                              		high
                                                                                                                                              https://api.weibo.com/2/statuses/upload.jsonSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://www.360.cnSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B82E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D81A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DE4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E29D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CA28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2137479601.000000000326A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D786000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DB2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CAEA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2055027527.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C1DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628181945.0000000004190000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000E11C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD43000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.1628668213.00000000046A8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DD89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000D9CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DEF1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://weibo.com/%d/fansSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://stat.apc.360.cn/stat.html?type=new&action=msgremind&from=%d&appid=%s&http://stat.apc.360.cn/sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6a/cake.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsByCategory&cid=%s&start=%d&count=%dhttp:/360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://zhifu.openapi.360.cnModeSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                          		unknown
                                                                                                                                                          http://www.baidu.com/baidu?word=%us&tn=ichuner_4_pg&ie=utf-8:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://down.360safe.com/setup.exeSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://stat.apc.360.cn/msg.html?type=open&action=zhucechenggong&360DesktopRegisterVerifyCodeDlgSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B401000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bc/otm_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d3/clock_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://swf.baoku.360.cn/gamebox/sorryjump.htmI360AppCenterDataClientTypeTabVisibleSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000B931000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c2/tooth.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://api.t.sina.com.cn/statuses/update.xmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        • 0%, Virustotal, Browse
                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7d/sleep_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000C41E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://bizhi.360.cn/uploadwallpaper.html360360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://pstat.p.360.cn/uplog.phpinfo0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000BBFF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeH360wpappInstaller_zhuomian.exe, 00000011.00000002.2153042470.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000015.00000003.2270017193.0000000003C41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeNSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DC48000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.1621866746.0000000000C77000.00000008.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000DDF4000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2139079044.0000000003581000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 00000010.00000003.2136893687.000000000052B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&veSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2224032969.0000000003E7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2160058813.0000000003265000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://www.360.cn;color=rgb(60SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049058349.000000000CD6F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                                                    		low

                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                    Public IPs

                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                    101.198.2.147
                                                                                                                                                                                    		unknownChina
                                                                                                                                                                                    		55992QIHOOBeijingQihuTechnologyCompanyLimitedCNfalse
                                                                                                                                                                                    1.192.137.108
                                                                                                                                                                                    		res.qhupdate.comChina
                                                                                                                                                                                    		137687CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePRfalse
                                                                                                                                                                                    171.8.167.89
                                                                                                                                                                                    		unknownChina
                                                                                                                                                                                    		137687CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePRfalse
                                                                                                                                                                                    18.161.170.106
                                                                                                                                                                                    		unknownUnited States
                                                                                                                                                                                    		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                    171.13.14.66
                                                                                                                                                                                    		s.360.cnChina
                                                                                                                                                                                    		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
                                                                                                                                                                                    138.113.29.74
                                                                                                                                                                                    		static.apc.360.cn.lxdns.comUnited States
                                                                                                                                                                                    		776FR-INRIA-SOPHIAINRIASophia-AntipolisEUfalse
                                                                                                                                                                                    18.160.172.19
                                                                                                                                                                                    		d2aydouiit1aqm.cloudfront.netUnited States
                                                                                                                                                                                    		3MIT-GATEWAYSUSfalse

                                                                                                                                                                                    General Information

                                                                                                                                                                                    Joe Sandbox version:38.0.0 Ammolite
                                                                                                                                                                                    Analysis ID:1367834
                                                                                                                                                                                    Start date and time:2023-12-29 00:18:35 +01:00
                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                    Overall analysis duration:0h 13m 14s
                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                    Report type:full
                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                    Number of analysed new started processes analysed:40
                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                    Number of injected processes analysed:1
                                                                                                                                                                                    Technologies:
                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                    Sample name:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                    Classification:mal51.evad.winEXE@36/924@30/7
                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                    • Successful, ratio: 71.4%
                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                    • Successful, ratio: 99%
                                                                                                                                                                                    • Number of executed functions: 162
                                                                                                                                                                                    • Number of non-executed functions: 278
                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                                                                    Warnings

                                                                                                                                                                                    • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe, StartMenuExperienceHost.exe
                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 204.79.197.203, 23.198.7.175, 23.198.7.177, 23.198.7.166, 23.198.7.171, 23.198.7.174, 23.198.7.167, 23.198.7.168, 23.198.7.179, 23.198.7.176
                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, crl.usertrust.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, r.bing.com, api-msn-com.a-0003.a-msedge.net
                                                                                                                                                                                    • Execution Graph export aborted for target SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, PID 6116 because there are no executed function
                                                                                                                                                                                    • Execution Graph export aborted for target regsvr32.exe, PID 1004 because there are no executed function
                                                                                                                                                                                    • HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtQueryDirectoryFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                                                    Simulations

                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                    00:20:41AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 360Desktop "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
                                                                                                                                                                                    00:20:49AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 360Desktop "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
                                                                                                                                                                                    00:20:57API Interceptor3x Sleep call for process: 360TopBar.exe modified
                                                                                                                                                                                    00:20:57API Interceptor319x Sleep call for process: explorer.exe modified
                                                                                                                                                                                    00:20:58API Interceptor5x Sleep call for process: 360wpsrv.exe modified

                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                    IPs

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    101.198.2.147http://china.cnGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          7YyaK2cB1s.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            1.192.137.108S38G0o4jF9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • res.qhsetup.com/drv/inst.htm?type=0&in=1&o=6.2.9200&p=64&i=1547068426&g=0&m=b8a4400180ee20f44982cb4d73d6fcd7&ver=&dm=1
                                                                                                                                                                                            171.8.167.89http://www.gourmethousemacau.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • s.360.cn/so/zz.gif?url=http%3A%2F%2Fwww.gourmethousemacau.com%2FIndex.asp&sid=d182b3f28525f2db83acfaaf6e696dba&token=dp1s8a2.bx3efd2n8I5/2m5ofc2.duba
                                                                                                                                                                                            instbeta.exeGet hashmaliciousBrowse
                                                                                                                                                                                            • s.360.cn/safe/instcomp.htm?soft=1000&status=10&m=4d3b36ce8a9789208f0edb9ce5b72107&from=safebeta_new&vv=10&ver=12.0.0.1061
                                                                                                                                                                                            171.13.14.66Inst7__9510085.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                7YyaK2cB1s.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  A1FsbRkm5m.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                    Domains

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    res.qhupdate.comS38G0o4jF9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.192.137.108
                                                                                                                                                                                                    d2aydouiit1aqm.cloudfront.nethttp://www.estevescaricaturas.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.224.103.104
                                                                                                                                                                                                    S38G0o4jF9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.224.89.158
                                                                                                                                                                                                    s.360.cn_____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 180.163.251.230
                                                                                                                                                                                                    _____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 180.163.251.230
                                                                                                                                                                                                    http://www.gourmethousemacau.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    http://china.cnGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 101.198.2.147
                                                                                                                                                                                                    Inst7__9510085.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 180.163.251.231
                                                                                                                                                                                                    A1FsbRkm5m.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    http://www.360.cn/download/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    S38G0o4jF9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    https://dl.pconline.com.cn/download/467865.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    instbeta.exeGet hashmaliciousBrowse
                                                                                                                                                                                                    • 171.8.167.89

                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    QIHOOBeijingQihuTechnologyCompanyLimitedCNhttps://www.az-partners.net/apps/driver-hub/download?ap=28Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.108.17
                                                                                                                                                                                                    https://dbrg.wxsckjz.cn/sem/childbd/f17.html?TFT=8&sfrom=206&DTS=1&keyID=0851&bd_vid=11240621751133777397Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.110.245
                                                                                                                                                                                                    eOIFF58KfU.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 101.197.85.238
                                                                                                                                                                                                    scorp.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 101.199.91.135
                                                                                                                                                                                                    SecuriteInfo.com.Win32.Trojan.Kryptik.HK@susp.11565.26013.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.110.226
                                                                                                                                                                                                    7DmcSNdUVT.exeGet hashmaliciousAsyncRAT, Fabookie, Glupteba, RedLine, SmokeLoader, onlyLoggerBrowse
                                                                                                                                                                                                    • 104.192.108.21
                                                                                                                                                                                                    file.exeGet hashmaliciousAsyncRAT, Babuk, Clipboard Hijacker, Djvu, Fabookie, Glupteba, SmokeLoaderBrowse
                                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                                    file.exeGet hashmaliciousAsyncRAT, FabookieBrowse
                                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                                    file.exeGet hashmaliciousBabuk, Djvu, Fabookie, Glupteba, SmokeLoaderBrowse
                                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                                    file.exeGet hashmaliciousBabuk, Clipboard Hijacker, CryptOne, Djvu, Fabookie, Glupteba, RedLineBrowse
                                                                                                                                                                                                    • 104.192.108.21
                                                                                                                                                                                                    p7b3Lz57YC.exeGet hashmaliciousBabuk, Clipboard Hijacker, CryptOne, Djvu, Fabookie, Glupteba, RedLineBrowse
                                                                                                                                                                                                    • 104.192.108.17
                                                                                                                                                                                                    file.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, Fabookie, Glupteba, SmokeLoader, onlyLoggerBrowse
                                                                                                                                                                                                    • 104.192.108.17
                                                                                                                                                                                                    https://www.so.com/link?m=bHHIH9gHiWMt7CT52Mk%2FHVbpA4Q7HLpfa%2Fe58lRjM9C9UVI%2BR7UmsSaIs1wIDRUJSJpxHEWC1%2BYp0sKM%2Fqs2t2rWnaBABhH9Okw2hj0SG5Er8qYCL76sO1Txz1%2BBPXh5CUJd9No6kEqqeY436Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.110.226
                                                                                                                                                                                                    9gbFT1d2ha.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 101.199.91.165
                                                                                                                                                                                                    mi2xF8aaxo.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 101.198.225.136
                                                                                                                                                                                                    _____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.108.19
                                                                                                                                                                                                    _____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                                    driver-hub-install__28.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                                    driver-hub-install__28.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                                    WwFUN1uab0.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 101.199.91.125
                                                                                                                                                                                                    CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePRhttps://dbrg.wxsckjz.cn/sem/childbd/f17.html?TFT=8&sfrom=206&DTS=1&keyID=0851&bd_vid=11240621751133777397Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.194.250.6
                                                                                                                                                                                                    http://www.baidu.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 36.99.50.48
                                                                                                                                                                                                    kpYawcK42x.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.56
                                                                                                                                                                                                    07diuwMEw4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                    • 1.192.193.72
                                                                                                                                                                                                    3nvoeHhdPc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.192.193.74
                                                                                                                                                                                                    arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.43
                                                                                                                                                                                                    o8YVsZ3s65.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                    • 36.99.213.123
                                                                                                                                                                                                    http://www.gourmethousemacau.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    omMuSCiQba.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.56
                                                                                                                                                                                                    MFHHpyEYrt.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.73
                                                                                                                                                                                                    6bpg019kR3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 36.99.50.35
                                                                                                                                                                                                    360#U6d4b#U901f.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.192.136.170
                                                                                                                                                                                                    f_005f4d.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 36.99.225.35
                                                                                                                                                                                                    SecuriteInfo.com.Linux.Siggen.9999.1427.20017.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.52
                                                                                                                                                                                                    DRL8J3CIbk.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 36.99.143.184
                                                                                                                                                                                                    bJhVWLP5lU.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.192.193.62
                                                                                                                                                                                                    skid.mpsl-20220815-1818Get hashmaliciousMoobotBrowse
                                                                                                                                                                                                    • 36.99.195.71
                                                                                                                                                                                                    xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.68
                                                                                                                                                                                                    xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    arm-20220709-0050Get hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                    • 1.192.193.73
                                                                                                                                                                                                    CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePRhttps://dbrg.wxsckjz.cn/sem/childbd/f17.html?TFT=8&sfrom=206&DTS=1&keyID=0851&bd_vid=11240621751133777397Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.194.250.6
                                                                                                                                                                                                    http://www.baidu.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 36.99.50.48
                                                                                                                                                                                                    kpYawcK42x.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.56
                                                                                                                                                                                                    07diuwMEw4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                    • 1.192.193.72
                                                                                                                                                                                                    3nvoeHhdPc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.192.193.74
                                                                                                                                                                                                    arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.43
                                                                                                                                                                                                    o8YVsZ3s65.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                    • 36.99.213.123
                                                                                                                                                                                                    http://www.gourmethousemacau.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    omMuSCiQba.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.56
                                                                                                                                                                                                    MFHHpyEYrt.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.73
                                                                                                                                                                                                    6bpg019kR3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 36.99.50.35
                                                                                                                                                                                                    360#U6d4b#U901f.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.192.136.170
                                                                                                                                                                                                    f_005f4d.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 36.99.225.35
                                                                                                                                                                                                    SecuriteInfo.com.Linux.Siggen.9999.1427.20017.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 1.192.193.52
                                                                                                                                                                                                    DRL8J3CIbk.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 36.99.143.184
                                                                                                                                                                                                    bJhVWLP5lU.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.192.193.62
                                                                                                                                                                                                    skid.mpsl-20220815-1818Get hashmaliciousMoobotBrowse
                                                                                                                                                                                                    • 36.99.195.71
                                                                                                                                                                                                    xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.68
                                                                                                                                                                                                    xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                                    arm-20220709-0050Get hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                    • 1.192.193.73

                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)360#U6d4b#U901f.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):271968
                                                                                                                                                                                                      Entropy (8bit):2.7198331920728727
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:xVepfNLvvRB47p+UMXDcOKXYumQN+o5kJAIcPXXvHsnRAvwwCaq:xVahBoMzcOnZ3e0AIcf0nRA9q
                                                                                                                                                                                                      MD5:20E69F7B55EA4F7A48736A19389BD2F9
                                                                                                                                                                                                      SHA1:B104DD43F009AF3AB490C79CA3FCD5BDB7585965
                                                                                                                                                                                                      SHA-256:6C608C5C17969CBFBD43051E860BBA4B9AEDDEDFE57A7310DA37024BA688CBBD
                                                                                                                                                                                                      SHA-512:36627BD215C2AFFD4DEC5E3FFAD5CFB7B44AE7FB2FBA4C582867AB248F88FFD50D1537CA86810CA107CF2A672E8016BF34B71C35EBD396C6A2C48AE66FFDABE1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N...............q.......T.......<.......e.......e..............<.......e...................................<.......................Rich............PE..L...9..N...........!.........0......'........................................0..........................................=...H...........................`...............................................................t............................text...b........................... ..`.rdata........... ..................@..@.data....;... ... ... ..............@...history......`.......@..............@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):724600
                                                                                                                                                                                                      Entropy (8bit):6.515371619339392
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:xnFslNsHuR4pg6uEBj/jRK5nYg2DNfMC+zFXTX94/wo9Tm5KO1f:5FslNsO6yft2JfMjzFXTt4V9To1f
                                                                                                                                                                                                      MD5:640F33B0059ED6EB89AA5133263846D3
                                                                                                                                                                                                      SHA1:F1BC1491BBF6DAEC1FB2B1AA3437BBA4C3D3D0BA
                                                                                                                                                                                                      SHA-256:677C9F6A9DF66F0F086931AD46B28B4C94BFF7A28960B8E9970B84801D633AD8
                                                                                                                                                                                                      SHA-512:14E3A419C0A75B3780903889A0D4921AB7487ECF53272C10042DB4D211D15C226A10CF8C25AA23E143EBFE77C15A7A9D6FAE3BD2F4EAA5A701295A8AA6405313
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                      • Filename: 360#U6d4b#U901f.exe, Detection: malicious, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^i..^i..^i..y..._i..v..Vi..@;..[i...&..[i..W...~i..y...Ci..^i..i..W....i..W...*i..W..._i..@;.._i..W..._i..Rich^i..........PE..L......P...........!.....v..........<Y..............................................-.....@.........................pX.......D..,....0..................x....@...S..`................................................................................text...,t.......v.................. ..`.rdata..B............z..............@..@.data...@....`...:...F..............@....rsrc........0......................@..@.reloc...q...@...r..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Preview.ui (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Preview.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Ver.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):49328
                                                                                                                                                                                                      Entropy (8bit):6.422529932487228
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:iCG1hD297LhgEl6n17lNOJG012doMRSX+aeun:7GU7Ngf17nAQRSX+ae
                                                                                                                                                                                                      MD5:906222E77961059370D5DAFCAFE6C012
                                                                                                                                                                                                      SHA1:69778D3AB991E5BF48C70DFF197ABE31AB45722E
                                                                                                                                                                                                      SHA-256:5645C19FE54ED2C736324B89C16E2DE5236EF8162796DD248EF3C89848BE1C4F
                                                                                                                                                                                                      SHA-512:DEE872E6A3E70319DBF0D66C67E0645A82176B83C1FB36D3B03F133E2F57A73662031E48F8F882B59ACBD072B7B4702D11122197C2D8C2B2813372D8B108843C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............s...s...s.......s.....s.....s..z....s...r..s.......s.....s.....s.....s.Rich..s.........PE..L...x8.Q...........!.....d...>......R................................................"....@.............................K.......(................................... ...................................@............................................text...Tc.......d.................. ..`.rdata..[............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):478056
                                                                                                                                                                                                      Entropy (8bit):6.69121493887301
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:JXTGWxHK5ZdldE/BvlqcmLaMlQnycplieut:LQ5ZdlQqpLaMWyRtt
                                                                                                                                                                                                      MD5:8701096D572C56DF7C41FA1987B69667
                                                                                                                                                                                                      SHA1:4675615065FE84A53B83FDD87444118592833C22
                                                                                                                                                                                                      SHA-256:CEE0805961B49B50E15D51E5EE5709B74F63D91B33B24147A6A328E81CA806CE
                                                                                                                                                                                                      SHA-512:B104A0BFD1156450FCD3AC21221D42571045E3C2C52D66E87B33332320627E11F443E1640E1F488A1EE59BC83B0E332E7C998932B56712D45021D0C20F048E39
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.)LS.zLS.zLS.z...zMS.zR..zIS.zE+.zUS.zE+.z.S.zk..zFS.zk..zWS.zLS.zsQ.zE+.z.S.zR..zMS.zE+.zMS.zRichLS.z........................PE..L...k~4Q.....................|....................@.................................rI......................................h........`...5...........8..h............................................P..@............... ............................text............................... ..`.rdata..............................@..@.data....s.......6..................@....rsrc....5...`...6..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360net.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):275288
                                                                                                                                                                                                      Entropy (8bit):6.682710718683491
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:Xxn20OeU6F/uixt2soJiM3EbmaOCs8WgNeDuctl4dzNQvB2YEGw069uK309tM0Xi:XJRUih2sevZsNeaVzSvBbX6019taPE
                                                                                                                                                                                                      MD5:E6FF763A4AC91232979560525E12E4C3
                                                                                                                                                                                                      SHA1:366D43F4C049137114FE0D72F84547632A399DD4
                                                                                                                                                                                                      SHA-256:250BBC73FECDA4023E52D0D07FB3B77889D4D20BBEA55C59304237F0A1D5F763
                                                                                                                                                                                                      SHA-512:2DBD3ACEC39CF7559DD22DF8F2EB2B1B5AE31D65599E3327F7910F375F10A49B7E6AC0A714A1C8D492D33CEFCC8955D5BE6D3AF7BE71B3BA94E54B5AA1437EC9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<.....w.<...G...<...=.y.<......<.......<.......<.......<.Rich..<.........................PE..L...{..O...........!.....f..........;...............................................................................0...z...|........@..h...............X....P..H .................................H...@............................................text....d.......f.................. ..`.rdata...s.......t...j..............@..@.data....6..........................@....rsrc...h....@......................@..@.reloc... ...P..."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360verify.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\7z.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):246632
                                                                                                                                                                                                      Entropy (8bit):6.5486755725416606
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:lUxMO3N5k6yS0ebgKEImqGGtzaIp3Pw8UjpkT7KoXICt7+3ex5rEQwpg:mlk6/0Ajfwt9kfZt79Mg
                                                                                                                                                                                                      MD5:6BF5C438B4F13F257E075B4A5B82721C
                                                                                                                                                                                                      SHA1:C9827FF84E04C62E326965330193D81115A7B710
                                                                                                                                                                                                      SHA-256:D251A672A8DCF9B03896CA462AB40A8AF62E0CB1CCF9333102311BDE8C28333B
                                                                                                                                                                                                      SHA-512:7BFA4E47134DB9CA95F6AC6142B9602F216696975925B0BA3E461C35AFFACA20A2CB48F6EA1D85193965226415F4EB3900EBB8D6DA2688FB49920118A563C87F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xy.:<..i<..i<..i..i=..i5`li+..i5`}i...i5`zi@..i..i3..i<..iC..i5`si7..i5`ki=..i"Jmi=..i5`hi=..iRich<..i................PE..L...(*.P...........!................6.....................................................@..........................f..p....\..x.......h...............h........ ..................................."..@............................................text...1........................... ..`.rdata...w.......x..................@..@.data....B...p.......\..............@....rsrc...h............x..............@..@.reloc..D........0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1182720
                                                                                                                                                                                                      Entropy (8bit):5.878790145137298
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:vQythN900YbDlxdml8TBcLZC58+bm/568r:v+0Wl0LZW8+q/s8r
                                                                                                                                                                                                      MD5:DFF6CB443FE4D03F1C1FA454E6BA6777
                                                                                                                                                                                                      SHA1:7C133A85C43F2FD4B318B7B3DBF0DAA4E0B784B8
                                                                                                                                                                                                      SHA-256:51590C1C13A3356F664BCCFE6F87EC80DC8CC275F2984CBA693D9B01F2DE0057
                                                                                                                                                                                                      SHA-512:E2B9267E5A26D0E9B886DBC4B4712899FA9166D3BF1A03359574DC7081A4B4877F65540232E59487ACDF07AEAFC943842E1B573A0684B1CB5F48DFACB4ACE926
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%..D.D.D.2.u..D.<v..D..g..D.<`.!D.<g..D.....D.....D.D..E.<i..D..w..D.<r..D.Rich.D.........................PE..L...^|.P.....................J......M.............@.......................................@.................................|............J.......................\..................................(U..@............................................text.............................. ..`.rdata...4.......6..................@..@.data...<........2..................@....rsrc....J.......L..................@..@.reloc..B............^..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):158568
                                                                                                                                                                                                      Entropy (8bit):6.396896358849047
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:LpgByzIin2++g7LXW9rLhQMuUKavLW1rA239Flao567MWse:LsLFCy9RQMuUKavL78Fqrse
                                                                                                                                                                                                      MD5:7A0E3BE308D1900CE4CD241A8948FD67
                                                                                                                                                                                                      SHA1:BA925C92F200D39666F91F018CD10D75DA1BFD74
                                                                                                                                                                                                      SHA-256:2305E91C09A60FD90C3963C8F95CA7032CC5696D4A122DD5C4798C9BC9343B39
                                                                                                                                                                                                      SHA-512:6D4FE7370C41FBBFAFF491207A342D19BBB5DA35F2DC4AACC683B1E6EF2098B4B2DC965E958B92D9154417CD1DED6699B6616F2B557FFAEB5277D347BA435CF9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.uA\.uA\.uAU..AO.uAU..A..uAU..Ae.uA{a.A].uA{a.AK.uA\.tA.uAU..AM.uAB..A].uAU..A].uARich\.uA................PE..L......Q............................z.............@.......................................@..........................................................X..h...........`...............................p...@............................................text............................... ..`.rdata..Da.......b..................@..@.data....R... ...&..................@....rsrc................(..............@..@.reloc..0).......*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1088688
                                                                                                                                                                                                      Entropy (8bit):6.560009016874765
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:3hQovqIB6QAnhTDxyGkA0FBVYOfT9dHtnTUr8U11zXJ:anh5nOB1fTnNnTUr8U11zXJ
                                                                                                                                                                                                      MD5:84070772563D6FF84A462E0ECC089A6A
                                                                                                                                                                                                      SHA1:AEFD66A7416B72B4CEAFFB3F734C0CB0DA96E24D
                                                                                                                                                                                                      SHA-256:0780014E5076B5AF7B00C5F54B2AF20D451A85CFFFD9C647EB1F24092FEC7453
                                                                                                                                                                                                      SHA-512:4C90843363E6A7C6687D03C95EC83BC97D2B6A3F2A13D6DBA0CC8266BAAE82E11DB031D89423A9C32C70B6C5361893BD4B98A754F7CC037C4CA7B453E8A1D7A0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Cr.>...m...m...m.\`m...m.kcm...m .m...m.Arm...m.kum...m.krm[..m .m...m .m...m...mX..m.k|mj..m.kdm...m.Abm...m.kgm...mRich...m................PE..L...DB.Q...........!.....................................................................@.........................P...............P................................................................@............................................text...[........................... ..`.rdata..i...........................@..@.data............:..................@....rsrc.......P......................@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):558536
                                                                                                                                                                                                      Entropy (8bit):6.585730875870462
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:2EspBEHRraG0om05h7vV4nkXxWy0gPAb+pCL4q9plyTlFeM6LSfUSm:XKE0TJkicAbiCLxpt6m
                                                                                                                                                                                                      MD5:FAF9DFFB6136E079875A3484C28F9719
                                                                                                                                                                                                      SHA1:6DEC0F4096B36D2BC47E5C34599EC02407C39A03
                                                                                                                                                                                                      SHA-256:437396474FF3AB9B1A6C79ABC8174A8641A9F38400EB1FAE068F2B233533275E
                                                                                                                                                                                                      SHA-512:88BA62DDDE2774DF77EF0A4BBB60A2C873AA78EE5EB2B385EFB2289778FAF4B7F98E4E9B9106B06E3074D0EB453F1879835612AD2B6002179BE6C92FDB437D94
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..i-..i-..i-...-..i-...-..i-...-..i-...-..i-...-.i-.c.-..i-.c.-..i-..h-.i-...-..i-...-..i-...-..i-Rich..i-........................PE..L...i..P.................J... ...............`....@.................................G.....@..................................[..........`M...........n.......@...V...e..................................@............`...............................text...@I.......J.................. ..`.rdata..*....`.......N..............@..@.data...<e.......D...d..............@....rsrc...`M.......N..................@..@.reloc...w...@...x..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DTSwitchBar.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):337728
                                                                                                                                                                                                      Entropy (8bit):6.542349002922983
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:JGOalWTNOn7XCrlxG2XjuwQBiK51uOVowDfwl+s8EkZpGW1eI8N:gvlWBk7XsxG2XjFYiK2rwDfpsdkZgQ8N
                                                                                                                                                                                                      MD5:0C6BD516E25819B3970AC08BFC4E714C
                                                                                                                                                                                                      SHA1:91326186199377DAD7A7D8673F4B221CFD78DC95
                                                                                                                                                                                                      SHA-256:DF2638D240CF56D5AF9130B921D20903837E3DF941B183695D2F9AC59A956A72
                                                                                                                                                                                                      SHA-512:95C9E45CEEC10EEF848C81EBB628EC99583F359E0E95AF6BBEC8F9ECB951A350BBA6CD951432995A41025F70FE7C86F90BCE2A0108E19C6ED38DBD5079197031
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.fFn...n...n...g..x...g......g..Q...Ihe.m...Ihs.q...n...'...g..N...g..o...p...o...g..o...Richn...................PE..L......Q...........!.........2..............................................P............@.........................0...L...T...@.......`...............@.......t3..................................h<..@............................................text...c........................... ..`.rdata..|...........................@..@.data....K.......*..................@....rsrc...`...........................@..@.reloc...I.......J..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3760960
                                                                                                                                                                                                      Entropy (8bit):6.516553406742661
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:rEEfHBcxvOZtQDR68oBPAaVNhr4OCQsfQr5OEeJPHfXhH3ihdzaHt:t+28w9VNhjoQryJPHfXhXl
                                                                                                                                                                                                      MD5:2A73AC6CA39608C3B4E0D857749C4EC9
                                                                                                                                                                                                      SHA1:E344442CAA863EF3235DEAA69DA7D0C64E7AA04A
                                                                                                                                                                                                      SHA-256:3E42972666B237C4FC16A412E1ACCD7D756AF95E5C05D71CDD07BC6ECBAB6FBB
                                                                                                                                                                                                      SHA-512:F5052D7FA191C34BE38AE4DE7E246BAF599504D8BA46DAFBF5D70E01C954011F353AF1BE59199B495C27CB370D390F94BFA85E20012F45678FF361F6169C53CB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................E.0.......3.....@........".......".......%.$....@.......@.........s.....,._.....2.......7.....Rich....................PE..L.....Q.................D+...........&......`+...@..........................p:......a:...@...................................2...... 5.@............D9.@....@7.Dn...y+.....................0./......./.@............`+.H............................text...JB+......D+................. ..`.rdata.......`+......H+.............@..@.data...h.....3.......2.............@....tls....).....5.......3.............@....rsrc...@.... 5.......3.............@..@.reloc..6,...@7.......6.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):433512
                                                                                                                                                                                                      Entropy (8bit):7.139106415773596
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:K+uQsh0TLpB9RHUlRK+/VROuKNomYjemfkUsrBuZ:sQsOTLpB954Rh/f2rmfFs9uZ
                                                                                                                                                                                                      MD5:E381639C72EAABDCBCC90BBED1508C03
                                                                                                                                                                                                      SHA1:B7DA0993B917596C6DF2B8D7D4A175A00309CFC6
                                                                                                                                                                                                      SHA-256:CA7F67FA6BA73843B7E7BA57E2796A0BF807FDA8D0444C27D42D8931E6B81FFB
                                                                                                                                                                                                      SHA-512:0A16E8C17EDB0B5E460EEA396AC1A9F43B35161532542389AA4905990AB2DE1A74B8D70ACA167D0145DEF77D6D7353DE723765B204462443448DAA4CD2E7A4F4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SL..-...-...-..b!..-...U"..-...U4.-....3..-...U3.^-..0....-..0....-...-...-...U=."-...U%..-....#..-...U&..-..Rich.-..........PE..L...y.,Q...........!.....D...B......H........`......................................ua....@..........................................`...+..............h........-...c..................................@............`..T............................text...@C.......D.................. ..`.rdata.......`.......H..............@..@.data....C.......&..................@....rsrc....+...`...,..................@..@.reloc...H.......J...@..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):123256
                                                                                                                                                                                                      Entropy (8bit):6.447135984845218
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:A3LTWXUh0wR0LgAd4FwoX+RFokK95ul77QDtU:AoG7R2gA8woX+RFVKeA6
                                                                                                                                                                                                      MD5:E6515A6F40AC15E0089576ADFB8BC2A9
                                                                                                                                                                                                      SHA1:57664562863873E14AA890CE1B0473FAB51BAAFF
                                                                                                                                                                                                      SHA-256:63F29E4E625FDD68D2AA3E651949CE2DEE027639E2310EE6AF3AC028F328C7DB
                                                                                                                                                                                                      SHA-512:E095FF40BC7155D379F6E37AC464A4C33A795B894E78C29062564B3C5307163CFB94ADBCE139FD4AF023532EB7315E7423E7B15201578E584FBBA23F3A4C3AF5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..x3..+3..+3..+:..+ ..+:..+^..+...+1..+...+<..+3..+N..+:..+;..+:..+...+:..+2..+-..+2..+:..+2..+Rich3..+........................PE..L...Za<P...........!.........................@............................... ..............................................tx..........................x...........0B...............................e..@............@...............................text....-.......................... ..`.rdata..+C...@...D...2..............@..@.data....A.......&...v..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):149864
                                                                                                                                                                                                      Entropy (8bit):6.805058005152224
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:BjmUXnUXrZWLAV2J9wxQpxSUhEEhMfpp8a55jvmiQ3N7nfRI1C5/:3XUbZ52JGyvhEEYEM43NnfRI1i/
                                                                                                                                                                                                      MD5:18E4132F71542139764F16858AD032E0
                                                                                                                                                                                                      SHA1:84A4B69504A4E66E550A529D9F994AC503563535
                                                                                                                                                                                                      SHA-256:8498007D828D38CC2625A8C0AB9449BDCA5A0C0F430C832F1DA426EAB1960505
                                                                                                                                                                                                      SHA-512:8084C631B2A4CCDBC34A663C167001FBC7FD22F2B8FEA72C0255A2E2B8F994B3857DB7DEA90AEE865F15A8155C6B6BF92428A3D344A56EEC9EC0CF2983EF06FD
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...........\.......J.......M.....}..............C......]......X....Rich...........PE..L...a..P.................`..........:........p....@.................................^.....@....................................d........Y...........6..h....P..H...Pr..................................@............p...............................text...%_.......`.................. ..`.rdata...C...p...D...d..............@..@.data...</..........................@....rsrc....Y.......Z..................@..@.reloc...!...P..."..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):163968
                                                                                                                                                                                                      Entropy (8bit):6.612538321745
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:wyYZvF3XAa0y2GIID/eP+gJ8TbUNVPavT+Rvleb0GQ3b25WGVmiQ3N7nfRIitQ:wp61yjZ/O+gZGve9m0Gy1/3NnfRI+Q
                                                                                                                                                                                                      MD5:476B86E7D05550919702E25541927DA5
                                                                                                                                                                                                      SHA1:682D5B245C419E89C0BC4A4BC5A4D3B2BE901492
                                                                                                                                                                                                      SHA-256:F4200B1587639E6F8B64E2CDAC798E60FE64BF26574CA4D78401440B67D9D8EC
                                                                                                                                                                                                      SHA-512:BCA25CABE7008EFC174EA6C7B386B733E5098F8AADBE7C1B3B6CCAFF3CDB3E5070FCD0A43F02C6B1AB86BEE1C86A77EF240C0A7FC4A8EF1E3801049D68B4ABD8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................f......p.......a.................u.....o.......q.......t.....Rich....................PE..d......P.........."......x.....................@....................................=.....@.....................................................d....P...Y...0..@....l...............................................................................................text....w.......x.................. ..`.rdata..j_.......`...|..............@..@.data...8;..........................@....pdata..@....0......................@..@.rsrc....Y...P...Z..................@..@.reloc..v............f..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):262832
                                                                                                                                                                                                      Entropy (8bit):6.439942220999784
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:EGRs/pNN5FBhx2k7dMboZVw128dPMbPLzvx:EJHpx2k7dMbYVw128pCT
                                                                                                                                                                                                      MD5:87D7A4C158C7859A915AF5B5BD4C3CE9
                                                                                                                                                                                                      SHA1:199F65BB350933C3584648159CAFE0B845FCBE37
                                                                                                                                                                                                      SHA-256:48A8EF3DD7B2F4367129CA765A4DE9A6FFC326978E7B9BB00638AF361882E7AD
                                                                                                                                                                                                      SHA-512:C18D8CDBF02846DB60EF34958B77E8D98822011B48A80DC9C26C372DDC77A7E9A31CC91AFD8A4EC8BC3C36F17EBAB5A2520E610BC25B338F230E5F82963D1836
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l.K.....l.......l.....k.l......l..>....l..>....l...m...l.......l.......l......l.......l.Rich..l.........PE..L...#Y.Q...........!.....H..........z-.......`...............................P......S.....@.............................U........... ...............................c..................................@............`...............................text....G.......H.................. ..`.rdata..%b...`...d...L..............@..@.data....C..........................@....rsrc........ ......................@..@.reloc..F8.......:..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Dtsc.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):682048
                                                                                                                                                                                                      Entropy (8bit):6.167243018513245
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:/1Ol+njQJKsmYfiazL1eh/W9p8RzjTjVIR7H2g1GWHnqfyN8:UlYjQoXlafZ3sTjVc2LQqfyN8
                                                                                                                                                                                                      MD5:1990F7E22374AE81A63142C5BC54B006
                                                                                                                                                                                                      SHA1:4E4ED0C40FF3F05D76A1D3965B126C0225C61584
                                                                                                                                                                                                      SHA-256:9BC7CEA5C5CB8D77E8B07AEA0F6BBD70DFD1F0A0CD01963A4F5C971C67C094AD
                                                                                                                                                                                                      SHA-512:BDE8C4F811CB38D4AEFA4A5B4A3D9DC8A865D4330CF5AC9675CE6B3BE94C41D7DF91B76A919FA308C2A7D15968B396BFAEE53BB9845A4A5697AB16B85FA731D8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1&.ouGi<uGi<uGi<,dz<wGi<.[e<tGi<.[g<TGi<.Xb<tGi<+eb<vGi<.O6<qGi<.dp<sGi<fO4<wGi<.O4<`Gi<uGh<MFi<Cac<.Gi<Cab<FGi<.Ao<tGi<RichuGi<................PE..L...k.5Q.................P...................`....@..........................p.......}..........................................@...................@P....... ...B...`..................................................X............................text....G.......P.................. ..`.rdata.......`.......`..............@..@.data........ ....... ..............@....idata...).......0..................@....rsrc...............................@..@.reloc...O... ...P..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Login.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1113016
                                                                                                                                                                                                      Entropy (8bit):6.641503286094176
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:+uGlpBgDHNQqYIWG5fsuHycQExuZe1g1ZOjCtg3mWiH95t4ElF:+uGlp+hYIWewcQ7e1g1KCOmWo5t4ElF
                                                                                                                                                                                                      MD5:4683D7FE36DA34D5C875615C63A780E7
                                                                                                                                                                                                      SHA1:9B8E25F57E5F2593EE27A2623571D0838B61E59D
                                                                                                                                                                                                      SHA-256:DECD4A9179E0532E02DA7283CFBEFD4F672899AE23F663F1CB40D41119A5FBEA
                                                                                                                                                                                                      SHA-512:ADEBEA3659220F22708810F5CB23007EF731E67CCE3EA48D3DE267D9B2A5DE12B1C63120DF302E299CA4E43AF3024A4AAD6E433B4F2C8CDADD0E86759D0F218E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........txi...:...:...:.m.:...:.m.:...:.m.:...:..{:...:..m:...:...: ..:.m.:...:.m.:...:.G.:...:.m.:...:Rich...:........PE..L....~.Q...........!................\........ ...............................@............@.........................p...3...t...T............................p......p&..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...Hz.......B..................@....rsrc...............................@..@.reloc..Z....p......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360MsgPushCore.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):812184
                                                                                                                                                                                                      Entropy (8bit):6.502754405925657
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:T/nhY+ZXDcGMheIibbzNRVcxr9diftAAo2V3U/tqjGrA0iarnm8JqnZDVcxANbjx:T/XA7YRy5ift421UlqX0iSnJJkZNSTTo
                                                                                                                                                                                                      MD5:7947B066A1A4B66CD2B9D086DE45D939
                                                                                                                                                                                                      SHA1:5AB237ED46904DCD43B4F0207D7CCB89E50C980B
                                                                                                                                                                                                      SHA-256:AF7DF81DC1C593591B92D6E4182A1186E9074204F6954A80CABBE42D2067CB38
                                                                                                                                                                                                      SHA-512:9F4FAA55AD701F13F7CBEFF90CA0057BB4AF94B58D3B6FDF02194382E04B698E79E2A94708684BCCE9D9F90F9649078333C2A876653C80918555FA52C1F1D5A2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.*1..Db..Db..Db...b..Db&l*b..Db&l)b..Db...b..Db...b.Db...b..Db...b..Db&l?b".Db..Eb..Db...b).Db...b..Db...b..Db...b..DbRich..Db........PE..L....A=Q...........!.........|......n.....................................................@.........................P...W.......h........C...........H..............0...................................@...............p...l...@....................text............................... ..`.rdata..............................@..@.data...........R..................@....share..............."..............@....rsrc....C.......D...$..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360NetUL.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):229360
                                                                                                                                                                                                      Entropy (8bit):6.679890430785069
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:RF494g2HDCpxH/cmBYpDIhjISo9TBVLnW/Z:Rm9OCHfcmBQnSo9TG/Z
                                                                                                                                                                                                      MD5:68A3D19BA62C6987E88CB2B7712B9592
                                                                                                                                                                                                      SHA1:E9B1C288165D09F2B0833719F7626FB39F96D350
                                                                                                                                                                                                      SHA-256:7893BB10C4291D70A48CDC3C65BDAE5D9DFE15DD3F84856CDA6A5A4E51EAAC09
                                                                                                                                                                                                      SHA-512:9A84096D56FB0C99A70BE69361FDF5F1ABE4583CEE4CB51FF12EB474CADF3CBD961952C6E78425E544F145A1FE8104B4E044ACC71A03BB30BD1A9C655E413842
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)..H..H..H..0O..H..0Y..H......H......H..H.$H..0^..H..0H..H...N..H..0K..H.Rich.H.........................PE..L...B..P...........!.................@....................................................@..........................!......d........p..\............b..........(..................................8...@...............t............................text...m~.......................... ..`.rdata..\...........................@..@.data....1...0......................@....rsrc...\....p......................@..@.reloc...+.......,...6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206000
                                                                                                                                                                                                      Entropy (8bit):7.026122439366733
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:cc3bCTobhqLoUA3oLNMALssaPgLWIC5E:c9Tob8RA3o5MAfbyw
                                                                                                                                                                                                      MD5:B70E8845A3DFB674910975E6D0C061EC
                                                                                                                                                                                                      SHA1:78CE9F4F2EF5B279098756E0A72D6A988D34F0DC
                                                                                                                                                                                                      SHA-256:0F3699581E563D52A5485146CAD04754A27209484084A7B766AD99E8B3FA0FCA
                                                                                                                                                                                                      SHA-512:B5F72580068F8F5A5A5545C2959D59FF9527E21D0B8BA05F0245FE1FF8937AB651070B877836CE9761D969F1FB8484CA7819CCAF3E9FFF0BA5AC264A7C4DEDA3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y}...................................l.........K........................Rich............................PE..L...-..Q.................t........................@..........................P......8.....@.................................`........ .......................0......p...................................@............... ............................text...*s.......t.................. ..`.rdata...L.......N...x..............@..@.data...@>..........................@....rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360ZMUDetail.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):911224
                                                                                                                                                                                                      Entropy (8bit):7.0009602288643835
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:rRyVJFexWGIXwsfo5kwkBhBy67kty69dGqMzIew8xU1BOdOse7D8BwXeqpDsa1Br:rIy6j7D6ElU1wdBePkMem7KU8IkkvaS
                                                                                                                                                                                                      MD5:4CB75E88940FBBF38AA5DA0277EAA5D3
                                                                                                                                                                                                      SHA1:B259DCEC0A8CAE18012AE450EE504F680CA64201
                                                                                                                                                                                                      SHA-256:7467F2D3792F5A8A127998CD7671175646260718F26336169A8E593527926DE3
                                                                                                                                                                                                      SHA-512:93F09FCCBFAADCF8DE94CB090381837843657AA6160E381DAD1F1FF191FDE9F6408E2CF2E889D0CACFCBB9DD6659E0B9B7C458B8BCB6CFA9E35A4CD108E75D05
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h#.Wh...h..Th...hD..h...h..Bhz..h..Eh...h.Z.h...h.Z.h...h...h..h..Eh...h..Sh...h..Uh...h..Ph...hRich...h................PE..L.....IP...........!......................................................... ......................................J.......2..........$...............x.......D\..p...................................@............................................text............................... ..`.rdata...U.......V..................@..@.data....Z...`...<...@..............@....rsrc...$............|..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360desktop.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1416656
                                                                                                                                                                                                      Entropy (8bit):6.752223665132809
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:KPEeBM4l7jeAJETbXGHFW3TwIT/GBy4mX4sDLjTl2KuyJ:n4lenQW3TwIT/UmosDPTkKuyJ
                                                                                                                                                                                                      MD5:4FF9E97CEF569C059704486FFB498DF6
                                                                                                                                                                                                      SHA1:CCE58F7749AB1257595D3F84C8170218B7D2E62F
                                                                                                                                                                                                      SHA-256:C909F9799A84653ED3A9FE178963475AA5FE81D5F29CF4DE6B67FDA000C8E429
                                                                                                                                                                                                      SHA-512:FC5F8B2736D97E60BC1D73E56C5C0F7585B7FC109DDC59E4962D577C518A4C4F5A342A7CDB2C96F579E3FE814BED123B42770D8D3A3929C3C02BB58A06B19961
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........._.Ef1.Ef1.Ef1.>z=.Af1..z?.Cf1.*y;.Nf1.*y5.Gf1.*y:.Af1..D:.Gf1..nn.Pf1..E-.Df1..E(.Cf1.Vnl.Gf1.Ef0..d1..nl.Zf1.s@;.Lf1.s@:..f1..`7.Df1.RichEf1.........................PE..L...K..P.............................i............@...........................9..................................................... 3..\.........................P...................................................H............................text...%........................... ..`.rdata..............................@..@.data...P3%......@..................@....rsrc....\... 3..`... ..............@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_address.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):378
                                                                                                                                                                                                      Entropy (8bit):6.911583061847822
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDskGDVJn6dD0B3hFP/kVKqOk84kTfhZDXLk/MP+6yTirUp:6v/7i0fLkGRJ6dcxFP/kEdk8hjDXLk/D
                                                                                                                                                                                                      MD5:CC56FDFAB4489EACA44A27143AE9AC2B
                                                                                                                                                                                                      SHA1:FDECDD5969BE0F89500C6402C9C64B202A6DC4A4
                                                                                                                                                                                                      SHA-256:163DB940619596F0569EEB0B7817C799C301E9270C3BDF85445F0871C4971E1E
                                                                                                                                                                                                      SHA-512:A8BC28ED92CABD4D8102CF57A54EBB1FCF8AE2C9E080BED37D56F5BD156BC9BCA5CBF3007B66C0D86815099ACCD82DCDA900EF0169353267C82265E36C1554EB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bb``.... .OE..j&..++k...@....%.*...3.{.........Oddd._.~]../........[.y?.....?..,C-.A.d.g.dTTTd.....~...@m...AXX.?....-.....L.H.... .io.....,......L3.@f..`..T........hb..l..n.+...C .A>`.V..MM.j........?.....C\\....J.(N.Z...............k.zEEEjz...w......Y.D.:b....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_addressjk.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):375
                                                                                                                                                                                                      Entropy (8bit):7.137923455086985
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDsxHtqeQHf9FBo4ftBb++V7QJxaqWnF9xxY/51EGzHsDgTel/Vp:6v/7i0fLptq1H1FlBbiPgFmv7SX7
                                                                                                                                                                                                      MD5:679EC2BEE9EE3A3E175C191B57D6809D
                                                                                                                                                                                                      SHA1:C65ED05227FB99A41262D93802FFB246490AE146
                                                                                                                                                                                                      SHA-256:2A35A97E93752B96878C801B678E126656066EB919BC39A07E7C0AA03746950B
                                                                                                                                                                                                      SHA-512:7DAB4E8C67990336473C7CB1F9BA782E42E352182FB424E3582BD82B9C7AD0C16D4CB845D933E5A79C4A8A1568AA38FA3AFF9EE838900FD6BBED8708573594B5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.@..G].......#.....w.-.Q.=...Az.s..9.A...6...-y..@:._..};3...Xa..I..+s.,..s._.,;.Q..l.}.&... ..Q...a.8..u]......P.H.T..H.DVUu1=.i........4...Rl.1....m..M...;.......q.m.....[,.QW...F..qL..K.F....(..o6......e.a.8..e.....9.`.....`x.?1C..OM.P6.9..0.1.f..2.;....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_bottombar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 28 x 70, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):895
                                                                                                                                                                                                      Entropy (8bit):7.736770296459366
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:sS89NJziudHJ2OsjhS+lxn2EEeSEO8aIW:sSUmSHwRtSZoW
                                                                                                                                                                                                      MD5:110D93BD46D87E3F9F2C22B984319BE3
                                                                                                                                                                                                      SHA1:F4CA5A7E2838D4DBCA6B8E5A85FE31C368792745
                                                                                                                                                                                                      SHA-256:F08DEEBC0E0573FC0B30C5F169D7912C3EE683578CBB45FB8CC5273E56A17108
                                                                                                                                                                                                      SHA-512:92D7C5D1C644EC2C7EB18EAC637F327437980225B3C7DE0FDB3EAF4DDCED12715512EF3EEB4682DD6F4A89F29473F70B57B5BCBDA77549809AEAF53279547CE7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.......F.....PzcR....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..WKn.P..0:H..z....O..^.f..T.U".0./...<rfHJ............/n.~........Ao.......#.>J...Z(..~....x...."....#...A.........).gt..1...s..w.Q>.*_B...3@...h.H?...{..W.}FH...3.w...(.......+.).hK.JX[.(...r....l%.......7.......p....2.@L..hE....iX.CU...H]Q..f.A9....W...............-y.-h.XB38.8.\.)Z>........9.\n....E..d.(/...a.....[Di._....a;.........Y.i.R`o.b..4...$...%.....T.J1..M-r...QN3.u...@.5......*.d...7R..6Y...L....J....^.tO..1..u......].@.l...U..k}.U.*A....[./.y.D...............8.d...6$k9.@F.S.m,.4..d...PT..."m.[EPu..q;......:.kyk...}.l..P..K..6....".{3J}.w...^K..4N..L`..P....l........}+<......r*Y.2z.$..)....:o.$*..+V#...7a7Z...S.%6....T0.P..0(.6].>...5,.|...2..r764...1a.vf..*.bjwe.....g.R..v.`~.m9.9.`..`..=[~..{..9Od.._..h...N.9.w.GG<..&..D.. pX......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_combocool.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):923
                                                                                                                                                                                                      Entropy (8bit):7.656747347784116
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:XiAybG+xVng2RZGlVvsbZ/2AxC0hchImNd:XinHxKEZRxSd
                                                                                                                                                                                                      MD5:66E91EE2905FBDEAA4E5C2313B8FDB13
                                                                                                                                                                                                      SHA1:B844EC343F2268ECBF4BEB0CD4D15D3033D2B17B
                                                                                                                                                                                                      SHA-256:E787531C78ECF94B1BE9166E1667F41D9BFCDBBB771B9CA9D97C02384287761C
                                                                                                                                                                                                      SHA-512:943526A7CC15571AA8E37301D839FB0762D0E4F25D0B44B983A192A480DBE6C09F8FA870528119C8BB6D3ED9DB7C6391DF5EF9A9060C475B1989711E99648505
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..KK[Q..wn...VP..B...HEl....$j....I..t"..ZA...-8...:.C.*.....5..uZ%.....=.!.....9g.....9...J....`...A[$.i9==m....///s."....5.L.........ii................M...V.....H....POzk.HNN.....`...f...v...r....;!.........@........[......@..f........z..w...2...../......H4.....If...r.....C.rZ{zzBsss..@###.....ogf.+I....X...+[IIInoo.......#..{}}.....jP...F.\......{{{}....yJ`.Im2.E.B...s..?.0.P...n..k....:....Dm2..I...qZ`..@.6..NO...A.x...fu`.kP..d..!XVV.s..(jR..d....p......Q..d!....j)//.....BQ...&.X...RQQ......UH..5.EMj.!..y.......s.n...*....5.H......@._477.9_[[S....l.A.61a.....%....SSS....V.......`P...1a4...J"..X,.q8....$V..sqq...........ZONN...u..a.cTG....0....3..........ZUU...$......Z...i..j7|t...@*.....1.....P.....8"...............z:.@...A..0VO2.([...D+,...>...._...!..4.5w.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_combocooljk.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):888
                                                                                                                                                                                                      Entropy (8bit):7.608052775689205
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:wPD5/xB8ESjaqJDjFthuOB1tn9i+ez3eiJqsGNU:wPF/DBSjhpFvd1tqeiJqJS
                                                                                                                                                                                                      MD5:B0A2B5855260AEBA0BEA2A6AF4421167
                                                                                                                                                                                                      SHA1:49679525EEACA9A97D910F6F0904883838E3D2A1
                                                                                                                                                                                                      SHA-256:5FF7AEE15318830BC40EA1402131AEDAF8CBFAD2AA914A628B5BF1D4B59703AE
                                                                                                                                                                                                      SHA-512:5F9C579666EEC68A1873469B010DA5AE9739BFB8326EDD009C9D795F4EB0BEB39C4DBD634B9577C8BD3F8D5EE3CFB9CAE492A2A4728A0C49FAE969E43E216A82
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...OZa.._^P.4...A.W$!.J. 5..B...C...X..v....P..]:....4.!..!..#.....yn..i5..r..{........`P.E4.ex.E(.....N...M\^^.noo.777.ZDL&S.h4f...6......c=.Ln=.h~~...;....)../..............WK)EKK....Z........Z...O.b..'...._......Q,..........eq/...A-j>...L....!..B\W....A-j.,,<@.y.F...l.......I.^...v..uu%P.C..MOO.O.R....0.....!0....I.B..R#........wvv......m.z<,8}..../...d.T*..4...Im..J..Z.a...T.....d.V.A...`..cS....X.~....=._............@..V...lj{.....&.YdWW...hmm....d .....0.T.F.NK........}.......z.6.!P..5.........-.-.|>.6..w.jR....b..`..../.f.|tt.vOm..G.D../"....###..^o.a...V`?.f......~..6.s..Y<E..LZgg.p....ccck...."....c<..,...\.7.a+.....K.Z...../S...!.N..............vee.....K..k....V.j...}%.#.4..7...L..g.|...Lq..H..!..[..."B....j'.(..=n..o..Mv..`.S.}s..g....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_menubar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 400 x 25, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2902
                                                                                                                                                                                                      Entropy (8bit):7.854538720952291
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:U/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7pz:USMllcHitlIxv9vk7C1+I4wWHLihk/xl
                                                                                                                                                                                                      MD5:EBFE7A6895A10C867E4178A8F34E2450
                                                                                                                                                                                                      SHA1:F0DFEB6F1A01CA08F83A98F194DC7052F1913CBC
                                                                                                                                                                                                      SHA-256:1D6AFBD5A688698A73C252089C9EBB8E5DAEA31AC2F701C7E7FC52B1D207E640
                                                                                                                                                                                                      SHA-512:057DC9A7E4E60560BC3564B658FBD7EA9448C4407D64ECABCCCE32C7F8D13912A279C6A836ADB571CFC7B04DEB1D3C85CF56E1DF4741B92A6991395D6B161BF5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................?....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_titlebar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 180 x 23, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2944
                                                                                                                                                                                                      Entropy (8bit):7.867012956447315
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:j/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7up0:jSMllcHitlIxv9vk7C1+I4wWHLihk/xR
                                                                                                                                                                                                      MD5:E7854C688AFC786BF49BDD6CE61521BE
                                                                                                                                                                                                      SHA1:DEC0B971F56FF413262E4619E1610975CA6D2846
                                                                                                                                                                                                      SHA-256:5A0819E87C40D4F548301F601A44DF02BC4D2E8AB1AF30D6F7AB76C77701BAE9
                                                                                                                                                                                                      SHA-512:A8304875C2DF8C6FA2C8CA9910A867FA9285519FCA055ABBE344FFB7C61A49559ED29CCC8043666B539E14B6E6F0214B40E082BDE79AD17C58A99AAD3BC346A9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............-'.%....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 480 x 127, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4458
                                                                                                                                                                                                      Entropy (8bit):7.848831874056026
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:n1PinBKex0NHeZOJnKb2tUsnL6xFRiljhz2kg+F2WLXbgEmtXKm6YYwI:1KBKexBOvthsRi9hz2SGZu
                                                                                                                                                                                                      MD5:4F1705C49D8B08621D8F47D6868CE563
                                                                                                                                                                                                      SHA1:104C2E7DB170E423D34892366548C3D9FF3532BB
                                                                                                                                                                                                      SHA-256:27F4DC9C58C766D8DEF55A8859DB30DF28168817649DDBE17E710A7A72606D8C
                                                                                                                                                                                                      SHA-512:84738EC8FB0AE48554E81D427B537E1298C4EF3C9EA961F8E8E05ACED7284C3FA333F7A87B65C785EC03E60342B7E73C179E4DA5F41B4572DDD9E754BE511399
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....7...Z{.^..S.....O.?xO.=(B.PT....;..:i..R.v..Y.O...#...H.G~.._....z._....".).b.K..[..{.~.pEu.G.....v..Gv.EnY..H*.v......vU.U......[...+)...).\<-.h*J..J...-.t...].>[.{.).-.(...m.T .&...w.....z.,h.B.....,rQR...n.r.;.ii.\.\.t{d.LOP..hV.\..^9...4C....h.c.$....;I....N.]...D....K.$b".k"R9.`.n......b.RwS....R..w..%C.;.V..v....I.g..t.$4.....S_..4Q...!..d..Dkt...^k.w..$.w...!SdzR2..r...1\\t.e..tbh.?...^:.;....Ly^s1..E........rK.u&.9...cd.......<...lA.....W[..i..y.%....8-a.<..!.!.5S^..)m....6-).uqc.*[Yi........J+..m..`+MJ.._E.U`b.*Y.Pfqd.LON...Zt...Mm..V]..rcXa.&h.[.%).t...{.a..V..K.K.~.$n*H......5.<;f.g..5..s..c.l...l..)..5kv.{..3.....W.+?..K.M.....x..k_.....q.s..V..o..;.P.Yz %.P..f..{.eR.d+D..Q.2..E'Q.ce.l.L..."I.b.c..!SdzZ2..4..f|)zHRy. ....i&.T.=.(f..o....sb.&...Y..-$Z.!f1j...H...V+.......z...l..`.k&...IfE..^..S.R...1/p.-.s..V.ii.<b...P..E..7......UI"....G.z

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\btn_title_close.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 112 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4388
                                                                                                                                                                                                      Entropy (8bit):7.912014293635645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:oSMllcHitlIxv9vk7C1+I4wWHLihk/xJCb32oVZBfXtLK5e/iEuV:oSHIIHUCD4waDS2sffXt+s/uV
                                                                                                                                                                                                      MD5:D4CADB6C7F66D6EB63524A4140CA1871
                                                                                                                                                                                                      SHA1:A00C017C57AC0BB45A2CA62F7E42AE17A02B96BF
                                                                                                                                                                                                      SHA-256:B5DB14B67EF9A65951B5F48F88BBF1F9BBF860240193AB67614D09BD34CCB2BA
                                                                                                                                                                                                      SHA-512:06350530B94C26D30A0B24D1320071D3DDF27CAA30CF442EE64DDD0AF962FBC964C45BB1CC45E1C47D4870891A474B4AFDDDF5927701C2EB400E92B071922E64
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...p................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\btn_title_max.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3741
                                                                                                                                                                                                      Entropy (8bit):7.899231445675867
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/xKsCmeJ:2IIHUCD4waosiJ
                                                                                                                                                                                                      MD5:A23B225B6D0B54B8DDA157047ACE3A33
                                                                                                                                                                                                      SHA1:EE403794BF7D7B6FA7FD34FAEE982E08EDD9A5BA
                                                                                                                                                                                                      SHA-256:D5C219976828E95119B4EEE98EEF949E0D2B451B03097D0BB51633888F784A73
                                                                                                                                                                                                      SHA-512:B5FB8038993647D1D4A6618D11AC6C6F156CB8A1E8F643B5241E7C11C567D80ED753DC05AF00F6704782E40BB1746CE42AA3D9B34BEB59CBBCD321F4D9303010
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\btn_title_min.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3354
                                                                                                                                                                                                      Entropy (8bit):7.890717225229663
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/x/eiGKlWXbp:2IIHUCD4wadSKG
                                                                                                                                                                                                      MD5:30304F398F360D180CCDCD986F0E4D52
                                                                                                                                                                                                      SHA1:5840F5D00051B44B4666373711FF3D5C5380CA17
                                                                                                                                                                                                      SHA-256:332E9605BB588B8113167DF564CD0A4463701E60526EFEAB0575621214A068EE
                                                                                                                                                                                                      SHA-512:C111BFE0C6566FEFDFFD107DD4BFD4196EE4DFAE87EDF0270FE3397078769EA34B9A2A44BA6A42D65A628C847B95D67B6E328AE86F586E625A02520932C633D1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\il_statusitem.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 208 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5267
                                                                                                                                                                                                      Entropy (8bit):7.956195186420475
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:finFlEbEhgZPgh3wBAep5ljSECEDAUQCUuhPldTCzpslcfMl/Bf:firkMxEAwma3ldT2aln/Bf
                                                                                                                                                                                                      MD5:2CFD765005431ADAAC5CA4C9FE73ABCC
                                                                                                                                                                                                      SHA1:99A1ADA7BE44393E827E9959C536C39043CE6637
                                                                                                                                                                                                      SHA-256:98C36162E3F977B1AE6E68CCEF6A6541ED2CFCB6FB455E53CD24D1FFA7FE55BF
                                                                                                                                                                                                      SHA-512:2AF338B4AC2A495314E5ADD13C36AA2FC40D6929C8EEA77B89F06FE5EA00986A4BF4543DEC7DE5C19F7E16737A4AE50693663E8CC80AC4A996C5C5AF750A8BA1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............gL......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...%IDATx..Z.xTU.~.d2..))$aR ...`(J.T.....?..,....... R.].D ......$.l.4!B..$.J.$...s..3.Ld.g.}.=z.....)..}.w.\........~^....Z-...r7.CmueT.B6S..2.'...;...57T....F....!..e=..@..L............"...m.U.pa.^......w^y{.{.H.......W**...J....x.X,..{K.[ ......L.....""!..C'....V.Z%..l....7E$.......u..M.6..........e..aw....t.9l...4..Y.....4...@dP.Z.......o.......B......I.x]s..S.....^..l;..x...h..,a...#.....f.Xb....L.Q.xh.n.k.y'O....8..S.=.O......[...o.:.U~q_.."...s.....G.9l=.h........=.......9.y.f.X...1c.@....^n.5X......a.l.m...e.?...&..b.....{o..c&..........d.LH..FL....).l..OO.?....v..0..$&..Iw......t.w..H.8.......a....kG.Um=v4}..=.O......j?~.]....D....}\.Y...y....'.,Xp[X..i1B^p..)I}..+.&..*U.9..o.c.d..7h}...B........&)........L.;w...co.wv....}^t..z*3}Qg...h.T..MM...-;.1a....7I..K.......i.3.'.P"..L.Cll\;.........1IPxU.6....pX.`kT.Q.bL<.m.A8S..j;..q....@U..2.LiT.>s.:..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\img_sideband.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 4 x 49, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):158
                                                                                                                                                                                                      Entropy (8bit):5.71235322396329
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlJOtEll7ncl0tRthwkBDsTBZtVdEAX22SQPx+PhitB1p:6v/lhPatE/gl0znDspVmATEPAtjp
                                                                                                                                                                                                      MD5:5118D10C7EACE902540AC439524318CF
                                                                                                                                                                                                      SHA1:4E077F9814418BFF4180EB0EE01846739D8524B8
                                                                                                                                                                                                      SHA-256:1A4D1DC5012178110061C72F88B019E59428744D5B98FBC4862945362ED217E3
                                                                                                                                                                                                      SHA-512:1AE78BB7A49E49EAC6CDA168202C35C3B7706DE545FFC89EF765FF4416C4EAE8D205DB7EEA815810F53284C71BC67F5FFB0E83A12C417BC909F33090F4DAF051
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.......1......F.`....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...0IDATx.b...?.2`...W...t.R.\@]].AOO...qT..Q-P..`.............IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\size_status.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):211
                                                                                                                                                                                                      Entropy (8bit):6.330054257939168
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP8AMzl0znDspvsKhlyVQ5Yn3xJRyr+px/bGX+lVp:6v/7kAMpLhhlyVQGhny6XEA
                                                                                                                                                                                                      MD5:A5099D3544E5202E9AEFFF353DE2C999
                                                                                                                                                                                                      SHA1:026DEA383560874AB38DA3E192F2241E3CAB9F60
                                                                                                                                                                                                      SHA-256:6FE17CDB2AE87788220F6D44551A6918111AFA6D1DB20E0BBD050CAD418DC7BE
                                                                                                                                                                                                      SHA-512:09F87D3D4660BCAF98AC6D9CBDC24A59230FF4A7724C2317FEAC61D196EE360A87A1270A1C4C8FD41B6EE647D767E7BAFEB55EA1C517B962460BD33F78FFDD02
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............w&....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...eIDATx..... ..@$i.:,.h.7..F|d|.x.nX......^k.Wk....).L..8a)%......Q..Q..y.#3...G8;....~;.p,........oO........IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\skin.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5489
                                                                                                                                                                                                      Entropy (8bit):6.585852073568794
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:0rEQE5pOV22c4LeR4Vraj7mKZTM8sAT8BDRYknQloo9AoIkKqIy/q:0rEIVxc4a9jv9Zoo9AoIkKqXq
                                                                                                                                                                                                      MD5:E1398061A627C60593085CC1386B6C68
                                                                                                                                                                                                      SHA1:647E88E4A8B910229F8C7FE76F2D4B783FCFD648
                                                                                                                                                                                                      SHA-256:B65FEE9AC2F2115808424515EB04E5D0FA10709758CC7E95DF01D355CC00D5A4
                                                                                                                                                                                                      SHA-512:AAC734FF7C9F0A8032365F57B8AB861F096A9FB3BAEF0EB32616FADCDDA630082F2683A48C2E6A790C738D745B2B9917BC2ACEC98CC6A695B62EC7528ADB569E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:#read only..[General]..Name=Azenis..#.........Author=JJ Ying Create, Breath Modify...#......Comment=A 2006 GUI Champ Best Overall Visual Style..#......Version=2.0..#......[TitleBar]..Height=23..#.............[SideBar]..Super=0..AlignSuperTitle=1....[Rebar]..GripperCX=6..RowLine=0..#..................0......1.........AddressButtonSpace=0..#......................SearchButtonSpace=0..#........................[TabBar]..ItemLeft=12..ItemRight=12..#.............................................#................................................VBorder=1..#..............Y...........PBorder=0..#...........................[Browser]..Border=2..Spliter=2..#............................................[ICON]..FAV_DIRECTORY=fav_directory.ico..#...........FAV_URL=fav_url.ico..#...............ADDRESS_URL=address_url.ico ..#..................[IMG]..BTN_NEW=tool_new.png..#...............

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_bg.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_bgb.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnclose.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4467
                                                                                                                                                                                                      Entropy (8bit):7.887524585572367
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xwfKkLVVi/xMQye6DWfaKl:dSHIIHUCD4waWRVVwMCnzl
                                                                                                                                                                                                      MD5:D6C5EA4C704DA7C98288EEAE2C4B668A
                                                                                                                                                                                                      SHA1:C55548295A566EDF4FB1047D6543CEF93AA7D792
                                                                                                                                                                                                      SHA-256:FEB9889385BA65246180CC47694BE22B81344B4141383C1F5DEE565C249ABF84
                                                                                                                                                                                                      SHA-512:004EA99AD6027AF356A7CE01ABEFEC9514D5BF2ECF275B1A72C0C44F631EFE10599CFC0AF48DE06516C2784D56FA59D406C8AC20DDE5C285EEB7EDBA93279642
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnleft.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3641
                                                                                                                                                                                                      Entropy (8bit):7.901710647211874
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xQJWHAFfvUmyhpy:dSHIIHUCD4wa+WHAxhOpy
                                                                                                                                                                                                      MD5:B112B85C2FA8B2520A5F0D5D63E19E63
                                                                                                                                                                                                      SHA1:991841D56BEAB6F9E01810510C14D18EE992C5F3
                                                                                                                                                                                                      SHA-256:EF7BE34F2A38FA86C0A01A65CAD72AF086105EBAE136F0213BD10F86022F7473
                                                                                                                                                                                                      SHA-512:45EA3B364D7E37886804067D160A3C066C038393D2FAD55A18DCDC65D3A58E38903AA1F41D8455887C4F4A9AE069E3478753E4180184E99C602B05C135A563CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnlist.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3429
                                                                                                                                                                                                      Entropy (8bit):7.889410060546279
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xE94bNjeIW4Ntv:dSHIIHUCD4waRQInD
                                                                                                                                                                                                      MD5:7EC39872A2DB36E8915D6AA8E2F881D5
                                                                                                                                                                                                      SHA1:224A440E2B0660EBCC89C3AD9A880A08F57F7D16
                                                                                                                                                                                                      SHA-256:E8FF2A17DC40ED150B1E53331C131190D7CA3ECDFBFE995E4226099BD66FA406
                                                                                                                                                                                                      SHA-512:CD32E9704BDE2462F2B411489F5DBFA974E3D00B37A0C81EFD524F2E006A7773F4A2ABBDC9AE9363E3C20E63DD54EB550FC3E8BB574496996A171B0AD8703E5A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnnew.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):786
                                                                                                                                                                                                      Entropy (8bit):7.546808003957644
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:LmaCT4VwffCMlEJ/ocRnaqxnZVXPcs20C3naWrhlm:LmSwffPyJRaq7VXP520C3nbdQ
                                                                                                                                                                                                      MD5:0B08617981E18967F72525470CBF3E77
                                                                                                                                                                                                      SHA1:2A79C7EADB99B2ABE4BACDB534369C9F048AD37A
                                                                                                                                                                                                      SHA-256:853D1856F1BB147DA4F791C187FCBCDD70A677E49585BC01F9FEDCAB297A6567
                                                                                                                                                                                                      SHA-512:86A4D861645EAC50DFE068AD5DB567FDBDCED333908A24BA2AC1AF40098971F6636975615309F6F167F3C3E7503F912EAFB60DF29E75360155BE1F0FEF367052
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...`................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..ZO..@.....<$....."^.R(.)...........=..So...~.~.^\X(.x.\*TQPH.....4....d&..<..A.o~.7o2...n.DrPe.....EQ.7.fS.....t......D.N........X...d2G...P...r.?.tP.#0..7W.Uw:...pH...D..:)..$...M..I\.......dB....m;..a..R..B.@....t...lFF.Q(..R..r9....V......~....H..b..j5.`.....{..kn...z.....i.m...V.0.h..h..=...*.....(..@.G->..p...y.....p..y..-....@.#vx.\.>.......py.Hl..A3..x\.&h.....q..../.C.9@B.9.X.....W...W......Z..oo..G.v........E.Ae.^...._....F..D...K.........8bc...w?....;,.<.._.z...>.z*.....?#....H6v...........?......>......gc.W.%.....0z,..C Z.......R...._..X..M..xQp......8..l.8..;..Q.....v9.X.l.....?..D.>u...C%.......(..%W.4@B. ..H.......s..E......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnnewb.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):305
                                                                                                                                                                                                      Entropy (8bit):6.175730934146871
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPkl/O/6TMMAYfvl5uUdHlOx815NwNYZbbhEzNoPoopj32OpXp:6v/7UO/6TMqUwEx81/Z/66dcAZ
                                                                                                                                                                                                      MD5:0408523A403C234A6FF5A73AFF360BE9
                                                                                                                                                                                                      SHA1:309304547079031CC9A7FF87C52BBD55CB82A68F
                                                                                                                                                                                                      SHA-256:4EBB1B2E9B7C5D035637D980BD08C67DB341B8CC1C3337E7D07774E2650CD1DA
                                                                                                                                                                                                      SHA-512:92C3D04F97C402BDE63532DAD510BB467409591BD140BEC0665952D49653352F577B0E3FCAC7B5FAA7964EC81324B6EA67AD3AC0F823AEB52C7F25868DD2E778
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...`................pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F....IDATx...1..0.@.x...8y....G..B=.....P.B. %.A..\~J...I.1......@.. ........l.<|.O..|..C..?>i..m>.wz.....l...M.u..g.DM....Q...=sd.$H.......?$.6...@.. ......@._.........0/V.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnright.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3664
                                                                                                                                                                                                      Entropy (8bit):7.891018711426157
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xjntMr/R:dSHIIHUCD4waRntMr/R
                                                                                                                                                                                                      MD5:716E2DC65E20E05219E10C230783356F
                                                                                                                                                                                                      SHA1:30B0C796C5AD8D3B623F7D67F6F974F07A61FFC9
                                                                                                                                                                                                      SHA-256:1F2F895C8E4CA97F21B31C0C6403AACE8F4339D92980B7A79B53B375CC85C8FF
                                                                                                                                                                                                      SHA-512:A137905D889304948059647ABF87A1623321A01246EE47E8B89816AC49CD69927D1D60C0DCC52F408F0C413205AE637E2B3BAAB75D72D4DFF2C1CEDA6FAFC26A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_close.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 69 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3914
                                                                                                                                                                                                      Entropy (8bit):7.895999769181624
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:ISMllcHitlIxv9vk7C1+I4wWHLihk/x7a8TnZO83:ISHIIHUCD4waj
                                                                                                                                                                                                      MD5:0F48448630F47F51E9E309B7C88109BB
                                                                                                                                                                                                      SHA1:60250A7CCB0F464DE5F3FFE60C5EA1596A997BC8
                                                                                                                                                                                                      SHA-256:3E439DDDA28EC24F0DCCF14DC427B874439E9F7502F8FDB1315E9180DD949BCB
                                                                                                                                                                                                      SHA-512:245F230F6AB9062E9FAE8E90703CFF77F22D2681C584B9CFF6D6B89FCA97E1C778B87530C4FF7ABE802973207D0DD00617082B017F6D820386CEF9801D881207
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...E..."......|......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_item.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3722
                                                                                                                                                                                                      Entropy (8bit):7.899224106584947
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:hSMllcHitlIxv9vk7C1+I4wWHLihk/xrXwL+o9qjbdc:hSHIIHUCD4waRg9qji
                                                                                                                                                                                                      MD5:45FEA5118EE9A74839DF56DAD84F56AB
                                                                                                                                                                                                      SHA1:A0D82C69D219CB8CD1404EB0166EF8B8C748B53F
                                                                                                                                                                                                      SHA-256:43E59E4ADFE9DAA9EAD1ED41FA17C6DC8056EB14FBE41DE60F4FC7A665BC6E93
                                                                                                                                                                                                      SHA-512:5ABD0174FEC6B8EC0AD9B0F38F52090958ED43837925F34A9136F9C60558B2C99203E9E13BA0761D2F486CA7BBD078D1CFF2E053B533A92D3100A6236C061F88
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_itemb.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2608
                                                                                                                                                                                                      Entropy (8bit):7.882785296810761
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:TDsqWxNpSU9R+FkrZaM6UbI00CGGLS3fIOYHfmonECkORJGk56JFPxGjfknTGIh/:TDsq0SUHnaBCQCGOS3yHfdECN96JFpWc
                                                                                                                                                                                                      MD5:178B8BDF1962943FB5DF07AA07A99250
                                                                                                                                                                                                      SHA1:A8FE3CC3BDB2F33751EEA61AD8717E00FAD4546D
                                                                                                                                                                                                      SHA-256:78FE192F2FF86421B48ACD46BD1CD78D319C47007ECF4BECAAE4F4B82C86F074
                                                                                                                                                                                                      SHA-512:DBCB024A2BCCF977AC148F8D4E5923F181ECB217B19DB775CBC9F4668CC9F31B0897BD816FE76DC98684EC6D9316F573E1EF40D14D94E3A79EF40D9E3CDF8395
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[Ko...>w8|./..%.l...70.....].(...MV.......?h.n..@..."....]4M...$....%Y.H./q...3s......aj....$........sy.I)a.f.M......4k.....Do..`j..>K.cd..<B(.h....b.g.Y...8D..Z...,..%..giD.....Ek).c<.D.)P.F.....V.V..hy....(.....F...m..5.:.x+...,}..3i..gVM.@...wZ.......5..j...!HJ}.<..khw.^.pc......g.J. .%N>PN.B.L..6..*...f[.?..+.....DqS.0.J......8*K.]/.g...eV...O.....i.Z..x.!.....9...........Y.)Xh.)........}....w......&...+._.P.No.../.7n.....@G*..@8...\~i......-..P,.H...GW.4.....n.uXn....|..5.0~.}....7().s.....T^.....x.B<ow:.).....y..g......o......a.....`.",WJ.^_......4.....I`...+P...u.....w...?.vk.M..h..&........7nf...A.....r..|v..>|..L...ad{G..?.D1....#.S.....y.x~...}.$....:.X7...v..7.C...;.\.8.}.8.S."O....4.D.\..o...^.....-......;v.J....B......u...5....S.s.a.........T.5.@y<....<P...K...Pa....^..A...R..y..@..+M..vHd.6........|>7..K........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\thumb.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 60 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):518
                                                                                                                                                                                                      Entropy (8bit):7.326106620215251
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7GLcAAqRUUpp359ikkBi4Q8pnTZtEWUQqBugrt/73:AAF3/359iq4ppTZtBPtgrtj3
                                                                                                                                                                                                      MD5:A19117ABBC4882C42E88A2C6ADEBBF80
                                                                                                                                                                                                      SHA1:A1939BE01CB3818BE8C4F37730BAD3E68504BFC0
                                                                                                                                                                                                      SHA-256:432616E5DE7157AE72488B761F15820841111E261588404D6DF558B15D80AF50
                                                                                                                                                                                                      SHA-512:6F2C9B881694FD621DFBB418B45953D132D21A8989705B406A8FE9F543890145167B1CAECB36DF690E5285673978CFC7A1983D9836FB93CA49E875C4CABD447B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...<...........?Y....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.H.L.#..zx........+V.S..6..'\....T..Ak...ZTv.5..a.*;p......8h.yX......@i.t..?...b...3|......`.....gg.x..b..4g!.....?3|..........M.y.z..>fgg.?x...gNI.............RSS...999.W.Z.i...R_.....W.--.g...d../B. ..A..I.;.....?{..=...4...i^hX......._2.....Y.."...../.^.d.6...t. ......\.........eff...rp.WRR.....b...hKk>.[Ft5o...Hmi.r.JW.rss.N-0._.....y0._.....y..C<.....G=<.............(.F....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tool_go.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3112
                                                                                                                                                                                                      Entropy (8bit):7.923572389677524
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:n37DTYmEYkOTrzGzTb40tllVYbG5DCAatTSytJtSak48ShiGJjAHs+zn4YiZCXEI:rDuYbITk0tllVtdCAaH+aXNhitCA0Qnr
                                                                                                                                                                                                      MD5:8617CC17BF0424619372F86C37EAF521
                                                                                                                                                                                                      SHA1:FA3F25348D619320F7642732A925B9875EFC077D
                                                                                                                                                                                                      SHA-256:C474475EC789A4C47972015385A8D6AA74289A9B6A995380CF32940E9ED0FD54
                                                                                                                                                                                                      SHA-512:E716D8B66C2CA7D55C1B3B133A8CE821F9DB9164FE6F4B20F763B2B60CD8A2182514E7CA781C7C85C9B8AA8CE4FE787664BF8DD34344E5B22CB5B2D896F035E0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.o......v..v.m...).i).}...XS1........a.~.J[...........4...c..n%.+m!....&m.p..N..........$d.l..Gv._...{...s.l6.....p..*...%..&..`....A.."$.1B......$.g.E....q9...i.<.P..`#T.j...B+.......c.A.9B?.O."..Q..t)%~).X.r.A...v.6.V.[....}...>.x.U.-..1<te...........K.WwF.....e$&>E*......mp.s..7n67m..]s...$.....+M-..Us.PR....u..]k.b..5p..U;.V................... E./Rq2......auS.....UU2_8...s...ap.#....H..s.P....\............z../...;.Ago8C..'..|...X..ZR.....GM...h.s..Z."....82...j....,V+..j..C...p..{......7...........}.9.p..<>..Y,...'...!....>.....F..j....5.42.3v..X.|.....e.[...+..JL.%...Iy..[.tw....j...H..3.9.e..4j5.f+\u.........CW.u....<.wp....{...^.p(H|.9.T0..p.............._(P.J.y....,..;..'.E.>.[.#.._...,QR.pY......-..w...ys.A<.@".(...D...a.J.{...d...@9Kd.m....;s|.>.<.B......g...@.%j...k.Q.<.G.a..{..|.O.@.h.I.x.n?%\.b..e.bx.WU..o.dRB,......_~..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tool_search.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3841
                                                                                                                                                                                                      Entropy (8bit):7.936794890178898
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:EiU+SxOJqQDBX4FQYoxhTr/MWJThCI5dY/A7nSX2gKgQ6:EiU+SmXRhTrkWJThc/62
                                                                                                                                                                                                      MD5:387BA64C9F45FEEF2E10A7ECEE89CEC1
                                                                                                                                                                                                      SHA1:FB01461E47D36CBE561BBEEBCCC8A514082C5001
                                                                                                                                                                                                      SHA-256:6813B8D9C948189546C6A2455836E1A125CA9962C7890882473C55AD4B58B3AF
                                                                                                                                                                                                      SHA-512:31E2B9B5DBEFAA35B69B3F27890A11E6FB47DB346E79B3722ACAFBBE222A60CD7996B42E0DC56B75E6905EB41902FC5F9398CAD18809114FCDA29ED750365EB1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.P..u...d.....)...!.....$..L].r..{.i:.t:u..L3.&..N...t.I...T.*'...*....-...I...<..~.z..x..*c..&Wsf.....s.=.|.+.....8ZwZg{,!...I.$....^...*.9... ...K....}H|.#.u.O.T.k.S....'...d.d.d.4........w.$#$}$.HzI.H.$n..0dt.#~*..m.]F/....4....n.\ 9Nrhrb....Q.e...c...1.'...F..........<...E...#..M,.!/W.S...X...d.6evy7=.+.9....^.Y.#J..B.p,...$/.{eU.JK.....L.......Fm6.Zo...5...v..."CZ.i8.WTT......%.........uc|t.....w.....p<2..>!4.yj.uf.B.....:...P.......l.a.V(..G..;I.I&.7..=q!B..$.m6..:W.lAm}..r..n7...b...R..*.tz=..Lz.G...8{...SS[..|L.m6.;.[...>... ...`x:.22.......S'.011..........c.["..[..v....|..l.6t.5.._.QaL.1(....$.}..R..e.....p...D...9...A&.B...$....>v...nv...<..R]].{u..d...].........9.-..!t.^_..2.4.JD.Kz.[.q_}.]}m.>.~...Q..f.WH.)..Jz...y%...m..{...eu.....E&....`.B....q....h.*...Z..."....b..n....y"....m..<....F(.K.S..H......c..q..F..%<7.d...i<..........<...u.z

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tool_sidebar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 136 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2980
                                                                                                                                                                                                      Entropy (8bit):7.904587672083421
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:XVxfPDO/ZqAS1dE6lCxzZMG5of6V+QZ198lcenvmUL8e2UsJXk0nxGEngbdFJAt:XVxjQbwEACxzZMGN+QZ198m2NweCNxvP
                                                                                                                                                                                                      MD5:E7FB4B50E574A0C6BCB91FF84A05CDDC
                                                                                                                                                                                                      SHA1:71E7DE26218A926857D6D3F24F9A27FDB7627ED1
                                                                                                                                                                                                      SHA-256:050AFEB2AB763D10D19031DF07F50E10C10A4A30EE969A9E755AEFB1FA4DB77D
                                                                                                                                                                                                      SHA-512:F404316C768335C5F55EEAB567751975AD8C8253CAF78EE172FAF201F33790714E404F3028BB8C5316187492E035B938AE5C186023BDAF3D740A30ABDFFB8B5F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR..............M......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...6IDATx..[[l...>3.W...5fmc'`,.K1 s)...&..B..*.D..RHJ.PU)...O}h.P).MS).$/q...+..C..&...$P.16..efw..s.3fm.....HG3....7.|.._.1....#..a^.S.e!Jy.....Iv.\@9.6y.-..<...r<.q\.e.Vf2.P.....CL@...z...:.{......i.........)...+O.>}.0..W.P..],...v.~.....y...PVV.3f....8|.p .......P.r.,T.....-l...}.........Y..:...3....d....K]].a....QS...9..........3q...#G........h.j.6........O~....o..S..F..-H.RP..}..'....B..[.N...t:=l.>.......c...o...a..K.....4.....&...eY.h...=....s....r...q......_t/........../^>....f.....6...4..c....w. ..8..D.U.z..c.X....../.u/B............D..^|.y.....g(...,`. I.`...E......].$..;...q...O..Mi.S....H=.m.dy..W[0Z,B.e.0k+.?."....y....n9y.....K*}...Fxfs..psu.C.!....u]<y.M..]..Z ......b.*o5zs.F.E.r=F.......~av]]K......^..Q.k..As..s.... .w]:u.....42........X.|9,Y.......v....{.Bgg'.ji..?..B.|....g[..Z..n^..'?>............".. xp....yuuk.uu .SUU5..&.1.f}:

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360wapp.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2055344
                                                                                                                                                                                                      Entropy (8bit):6.501574992303422
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:7TmiYzj+x7bTWqC1QRmQ8KeIzHlyaZL3iY4AUrnGs/RLIHfs2lFfjErTztWCCwu:GiYQj5sIvFyeCZyHfs2Lfj8tW1l
                                                                                                                                                                                                      MD5:2EF1EAA12A6DB2793C2981DAF6E5D885
                                                                                                                                                                                                      SHA1:FBD587CF30AFC8CFCC6B579D31FD390E05E5A105
                                                                                                                                                                                                      SHA-256:E0358A4AF7258EA9901120D18EDA96F027E879A72A9CB3E5AC3D9EA183916AC9
                                                                                                                                                                                                      SHA-512:F9F0917DB1379032577D423674B69E796E9BB72144FC28DE5D86EDA473D8572E3ECF040DAF95CD20914C7E5F40387587A1DD060E632388AA82A4D5653A52748D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...h...'..._...'...u...'..._..n'.......'.....'...'...%..._...'..._..,'...u...'..._...'..Rich.'..................PE..L.....Q............................T^............@.......................................@..................................A..|.......pJ...........B....... ..TG..@...................................@............................................text............................... ..`.rdata..............................@..@.data....V...p.......X..............@....rsrc...pJ.......L...h..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ACS.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterCore.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1157120
                                                                                                                                                                                                      Entropy (8bit):6.505465407208107
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:kMsqyPFCyyLIyN/VowTqLbz4nt9GIy9knbKHbgHmbq032Q7x720WNmrtYVhapjUI:pwPFIIy9uwV/NYsbsbqV0WMrtyDGD
                                                                                                                                                                                                      MD5:3370C6FA90EFD8CA5C88E7DB8706247A
                                                                                                                                                                                                      SHA1:1BA328300E3021DD1AF86C27E7E5A6436C4F1EDE
                                                                                                                                                                                                      SHA-256:6D51C3DC16D1876CB4AC691BDB49C3D662F76C92F423BCBB1497B3D07AA831E8
                                                                                                                                                                                                      SHA-512:E4328F0420807ECFE586E8BB597134C80BC107106BF41A5E35088706ADA545C89A81F199B88155BFA1EB30800DCDB80F9F2636458C03CA67942EFBEF30624A25
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E............................#............V..&......&...............n.......................Rich...................PE..L......P...........!................sw..............................................6W....@......................... :..v...l...................................X...0...............................H...@............................................text...L........................... ..`.rdata...J.......L..................@..@.data........@...n...*..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterWnd.dat (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterWndChildren.dat (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterWndDisney.dat (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppSCProc.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppUpdate.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):209864
                                                                                                                                                                                                      Entropy (8bit):6.5024107808001474
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:CA1daG2oc26b4J+kxQLuUWyEefSut5GgzLhsbeOjunR5+hGv7drG:Pd92oczb4lx5VydfSut5UBSnCwrG
                                                                                                                                                                                                      MD5:4041E2D714BB833F85C49BD952DB8D70
                                                                                                                                                                                                      SHA1:4BA4D999FF511D5295B5CD3DC6A83F55442C595A
                                                                                                                                                                                                      SHA-256:B7E10B3B16A7E10CBE310C2213268467E63D2B50E1CC54754976CB1B020B28FF
                                                                                                                                                                                                      SHA-512:AADD060D0BF73969CAF0F985FF8895BBA530E3968A0AC53D12C890466840ABE7A241E120F2BDBDEA23BBD62C36584419CA86A910C9A1508C07C892AEA1592B02
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b...b...b.......b......tb.......b......b......b...b..\b.......b.......b...0...b.......b..Rich.b..........PE..L......P...........!.....T...........Q.......p............................................@.................................d...d....0.......................@.......r..................................@............p..(............................text....S.......T.................. ..`.rdata...e...p...f...X..............@..@.data...\C.......&..................@....rsrc........0......................@..@.reloc..h1...@...2..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppcenterData.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):665448
                                                                                                                                                                                                      Entropy (8bit):6.307152211676421
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:8ewM5egdD0nHwv1KDs4fU3Sd5H+pscGKsyClZ9Q17:H9TdDicDYepsJKsBQ17
                                                                                                                                                                                                      MD5:2C6A3D174572D20AD836EA64CE31EFC6
                                                                                                                                                                                                      SHA1:9CB1D008A248E6806D5548DD960B66C68CDE0BC2
                                                                                                                                                                                                      SHA-256:C4DF348797791A91A3ECF05D1375CDEB26188B4273F794041A67A2FF4D50783A
                                                                                                                                                                                                      SHA-512:85A1619C5458239044EEA9E4C56B129350CA4D7E844FD74648BFAA18705F8055E1A01FB34280746E3587092F2A72632B922683EB37BF0D7D7C8E7DD964F2709B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}=J.9\$.9\$.9\$...I.8\$.'...<\$....8\$.0$.. \$.0$..\$.0$..v\$..._.6\$.9\%..\$.0$...\$.0$..8\$.'...8\$.0$..8\$.Rich9\$.........PE..L...uz.P...........!.........v...............................................p......a.....@.............................................................h........W..P........................-......p-..@............................................text............................... ..`.rdata...5.......6..................@..@.data...XG.......&..................@....tls....I....@......................@....rsrc...............................@..@.reloc..8u.......v..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\BizPluginCake.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):198104
                                                                                                                                                                                                      Entropy (8bit):6.617352366925133
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:WRs3qPoZ5nmGk66yCXeyqv79VDNLcYHrwDzM5d5sv0oSDnzBTfn5D8Xjs8:NfsBqvJFe2rwHM5d5svFG97dijs8
                                                                                                                                                                                                      MD5:1A069A853EF0B9547D10C9E55624BA23
                                                                                                                                                                                                      SHA1:47FC9336E7DCAF28BF699AEA213E87CD8EB349C5
                                                                                                                                                                                                      SHA-256:A9E66ADEC4C6910A9A569F3EC6FD40B415FA37AB395C09C679DFF84C0D01DEB8
                                                                                                                                                                                                      SHA-512:6421533452420A19DA488C7E1B1D24F59E9BEE7B70FFD898B361758B4444E284E2549A38E7ECC8D455A6A4A673EFE41DB60A778BB8E9689582096087C5FBB2B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.V...8...8...8......8.....8.... .8.<XC...8...9..8......8......8......8......8.Rich..8.........................PE..L.....[Q...........!.....<..........*........P...............................0............@.............................................................#...........R..................................@............P...............................text.../:.......<.................. ..`.rdata..OX...P...Z...@..............@..@.data....:..........................@....rsrc...............................@..@.reloc..|(.......*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\BizPluginManager.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\BoxUI.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):894824
                                                                                                                                                                                                      Entropy (8bit):6.52386078019351
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:FB/l9ImbX0RJsEZ1h5YC8kFjg4698fng+Ae8niUP6ZMlvj0+nduqpWTyEd7ml3:FFTgsU1YWEnEnJAloZMlr0vq4TRml3
                                                                                                                                                                                                      MD5:8D42784F8758FFEAAECE44B131CD8C76
                                                                                                                                                                                                      SHA1:455E4E7175EEA90C625EF99336856460DE77333F
                                                                                                                                                                                                      SHA-256:378D1DAE7BA0C554F354586589F56FE818320C46537A1004475F902EC205B082
                                                                                                                                                                                                      SHA-512:A5F659423112CA7C65DD8759C6C1E1DBB041F4DF9594FF0CB679652D03ACEEF17CC8CBAC7D2B9CAC749D6166B5AE74B0180BCCB82F323576669A19285C9AF7A5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................e.....e.....e............a.....w.u....p.g....p.....~......f.....`.....e...Rich..........PE..L...p..Q...........!................(........................................ ............@.........................0...N...<...@........S..............h.......\.......................................@.......................@....................text............................... ..`.rdata..~S.......T..................@..@.data............T..................@....rsrc....S.......T...>..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\CatchScreenTray.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):531400
                                                                                                                                                                                                      Entropy (8bit):5.943047165437147
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:YAPBD8ItjByZ3JeByKzdA0CmWZyYNgHQ/E5g2HNnqOr7bg:YAPBD8ItjoeByQSMWZyYNgHnq21Zrng
                                                                                                                                                                                                      MD5:5D769795FA0B32B7E7AAB82E6F87CEDE
                                                                                                                                                                                                      SHA1:CF780D816C495758C0DDE8B96733C585D6269F84
                                                                                                                                                                                                      SHA-256:74B38BFD569F1421F29BDB0D34F95ECE9442792376A337E45B98021CC4E5E37C
                                                                                                                                                                                                      SHA-512:18A5BBA59FA14F1F6E772F6771E670BE9A1FC3581AC56E9444E2B56807D385F85F8FA663042CC61582C4B5E3C70AC76B43ED55A4C8185A46C45604265F543A17
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.QKe{?.e{?.e{?..4..d{?.l...{{?.B.Q.d{?.{)..a{?.l...C{?.l....{?.B.R.g{?.B.D.D{?.e{>..z?.l...;{?.{)..d{?.l...d{?.Riche{?.........PE..L......P............................qz.......0....@.................................Br..................................................\...........................06.................................@............0..t............................text...)........................... ..`.rdata.......0......................@..@.data...@........h..................@....rsrc...\............N..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\CloudTaskCenter_naive.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206656
                                                                                                                                                                                                      Entropy (8bit):6.533353933032578
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:7pug/0vD2hdIdDNZ6oyY15afle0TK58x3lap:7pug/YKTAAoyE65la
                                                                                                                                                                                                      MD5:BD0A2A0341F0C0CBE91ED912DCBB62EF
                                                                                                                                                                                                      SHA1:7DDE8B27275CD93053D98EF3083B262A395FAFED
                                                                                                                                                                                                      SHA-256:B4DFB4A0970548604908372F43783514D17C021C2AB65D5C12E61FB0B38C4B5D
                                                                                                                                                                                                      SHA-512:AB390186B9190A29445BAC113636E9F613B3E4E2E77BF82406ADCF99EB1CCB10E1605C1D570A3522B15F1D723932F604E4422DB76749D57B7A9D635AA855593E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..k..k..k..,k..k..:k..k...k..k..k..k..=k..k..3k..k..+k..k..-k..k..(k..kRich..k................PE..L...F..Q...........!.....\...................p............................................@.........................`...........x.......................@...........Pr..............................H...@............p...............................text...7Z.......\.................. ..`.rdata..ZY...p...Z...`..............@..@.data...d...........................@....tls................................@....rsrc...............................@..@.reloc.../.......0..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\Config\config_Bin.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DTCrashReport.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):253616
                                                                                                                                                                                                      Entropy (8bit):6.269768372575183
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:Luf0V9jblulC9FT2saGG1VLErK2RaqOv+TBRjp3L:Hug9FT251Vz2cqOv+TdL
                                                                                                                                                                                                      MD5:5DC6B9FBC85018A912A166C5B7C6515E
                                                                                                                                                                                                      SHA1:51DE39B4CBAF5F704464EF43FD89099D96A540B4
                                                                                                                                                                                                      SHA-256:BAF48D4858CF440C64A617EB6FB0DEC7FA821A7136DA9D89A2FDE43CF09EB95D
                                                                                                                                                                                                      SHA-512:A4FB4EBD7E5DD00C3CDC86A0F11100623348E57218DC417D55F625FA0EDF144971E39B60A040684241F6F4FE13D68397AC8F47D251F677A1E3A51098A4235433
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xzq.xzq.xzq.q..lzq.q...zq.q...Ozq._...wzq.xzp..zq.q...fzq.f(.yzq.q..yzq.Richxzq.........PE..L....Y.Q.............................+.......0....@..........................0......@-....@.................................L........0..@............................2..................................@............0..<............................text...o........................... ..`.rdata..L....0......................@..@.data...@I.......,..................@....share....... ......................@....rsrc...@....0......................@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DTQuickInstProxy.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95608
                                                                                                                                                                                                      Entropy (8bit):6.367483084267698
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:vLrdUPI24KL2zLaTRasZpLqCtQyZOUAkko5Rdj5IuwS5wCaD:vLrdUPI24KLbM0LAyZ1dj5Ic8D
                                                                                                                                                                                                      MD5:9C25145409A526C663D25822A2B8201A
                                                                                                                                                                                                      SHA1:4C22A4D2FF1450DC43503B161A44DC44499A4292
                                                                                                                                                                                                      SHA-256:5EBAAF4478F9ACA39BE440E687FAB7614C1CB51DAF679EE0B89FF40EB741B825
                                                                                                                                                                                                      SHA-512:78D6DE19AF8DF9862D0EDCE551334109A10F108D185596F8C36CC586F2CE9DC28D528888E153CC2D0F892A4B6D6A174BF693F2D39A1F7967ED440D54579EBA5C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..h...h...h......h.......h......h..J...h...i...h......h.......h.......h.Rich..h.........................PE..L....a<P.....................v......SY............@..................................?....@..................................+..P....................`..x........................................... ...@...............x............................text............................... ..`.rdata...3.......4..................@..@.data...`>...@..."..................@....rsrc................@..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DTShutdown.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):240304
                                                                                                                                                                                                      Entropy (8bit):6.486048784542187
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:pWmcumWKrd6V0v2QiDv3kGeeL75oe8D8lhSOXYox0n72FspCMX5CBaaaakcDCkqG:znalij3CHD8lhBotaF8CMchtqji
                                                                                                                                                                                                      MD5:6F712FAAF9EDF362136780C25455B1DB
                                                                                                                                                                                                      SHA1:1A968BC1596B0CDC1A4E795A2EA662848CF2331B
                                                                                                                                                                                                      SHA-256:9A693E0A675BFB8A4713B7822FFC608CF6BA2D4441252039C619FE345AD57E3F
                                                                                                                                                                                                      SHA-512:E5BF190D46219DCEE909CCD6EF46168268412BED4686B11AF06E211B56106158F7E57FC03572293E3BA7728DC55F3B3827836D091DF47589DC13C206451F6EC8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<@..]..]..]..%..]..%...]..%..]...C.]...U.]..]/.\..%..]..%..].....]..%..]..Rich.]..........PE..L......Q...........!................................................................i.....@......................... 8..h.... ..................................8(......................................@...............D............................text............................... ..`.rdata..............................@..@.data....A...@...$...*..............@....rsrc................N..............@..@.reloc...:.......<...T..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DesktopSkin\360DesktopUi.ufd (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DesktopSkin\MusicIeBrowser.ufd (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\FenceDistribution.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ImportFavHelper.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):716464
                                                                                                                                                                                                      Entropy (8bit):6.887338423237583
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:SXobqb7txh0BHw/dq70//Le71eBSlX4QwfgW3hFHOnNGzjuzG/SY0ekSkS2L:Wqe7oq014Sl/wV3/HONGfiG/US
                                                                                                                                                                                                      MD5:01E6C6FD97BF4F23D3CD5BE9E4BE53DB
                                                                                                                                                                                                      SHA1:F691E5EF40701BFEF9BD88FF50B46E2793772F8E
                                                                                                                                                                                                      SHA-256:7FD2A1A53E3EEB2CF446C611BCE1DE50E26B6E46680520FFCD0465D04D9514E6
                                                                                                                                                                                                      SHA-512:64C45D755EA64C9731A7D63E6AB5DE6ECAE6D55956B3EC0C0BABEA713C57E31139E4201974E6F2980703EA5B210D94BECDF04A54B647BB816480DB7A1192FDFA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.Va$.82$.82$.82...2%.82-..28.82:..2 .82-..2..82-..2k.82..U2%.82..C2;.82$.92z.82-..2..82:..2%.82-..2%.82Rich$.82........................PE..L.....ZQ.................$..........o`.......@....@..................................r....@..................................S.......@..|........................K...D..................................@............@..@............................text....".......$.................. ..`.rdata...%...@...&...(..............@..@.data...(....p...>...N..............@....rsrc...|....@......................@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\10\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):320
                                                                                                                                                                                                      Entropy (8bit):5.326804241243158
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xMxVLKOSrPjnFXirPZNbUQ5l3nZKARTKRo0Le8MqcsNJs:2VLViRCrbd5VnZK0TKRNSsNy
                                                                                                                                                                                                      MD5:54474DB3D028B1527B7259E6427F7DED
                                                                                                                                                                                                      SHA1:CCB8D4866FFD17CF518BEF9E18FDD441DFCBD4CC
                                                                                                                                                                                                      SHA-256:62A5F86D26164A133C033B8A09EF5137C73FB45A7EC4563EACD4B016C8351230
                                                                                                                                                                                                      SHA-512:FDCDE8E131D79EBC4E93F0F8BBD41709ED4C8CF79A8BDCFAB57B9067B7855498E0BE4E3044C0C4BF3BA4CE9A141B00CA5646E06B23EAE1EA760CC8463A7A7E87
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=10..version=1.0.0.1001..name=........*............[AppSetting]..icon=logo.png..smicon=logo.ico..frame=1..title=........*............url=http://static.apc.360.cn/cms/skin_uploadwebapp.html..catch_img=back.png..width=760..height=480..timeout=10..fullscreen=0..rclick=0..max=0..vscroll=0..slideeffect=0..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\10\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):9662
                                                                                                                                                                                                      Entropy (8bit):6.561898688748442
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:sUcTe6rqKLcgvdeqz+Ql96HAyHX3LpCEqqNjllgPxxXJitQp:LKIgvAsl9IAynzqOLg/ZyQp
                                                                                                                                                                                                      MD5:2CD835A7A37080E6407EECE713D94D85
                                                                                                                                                                                                      SHA1:0B3C0DD404B8283649E297577A07D061B1E027C2
                                                                                                                                                                                                      SHA-256:0573D5F151A829FE8795A1EFBE2B22CB50F70B52E674E628867F6C35578C1890
                                                                                                                                                                                                      SHA-512:53DB5DD3CBFB899C3B308C15BD0657E724D60B29533EECFD90704A8D8EA99BAD4A7F9F3FFDE2CAF9F119E3B53C80C5260A96FD214423AE31335B97EC11BCFE41
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%......(...0...`..... ......%.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................a122.0/0./10.132.132.475.<>>.JKK.TWW.]__.dhh.gij.aee.[\].QRR.FIH.;<;.465.344.376.585.698....Z....................................................................................................bcd.^``._`b.]a`.^bc.rss.............................................chf.bec.bgc.efe.ffe....w........................................................................................................................')+.........................................UTU....#....... ... ...'..............................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\10\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1018
                                                                                                                                                                                                      Entropy (8bit):7.745716050054846
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:GiTESGwxRqlt1m830H8v5DbpT53H/+kkz6iqR0:ZYSGwnqiH8lbpT53H2kNhG
                                                                                                                                                                                                      MD5:463682E0470747EA57EC16831288666E
                                                                                                                                                                                                      SHA1:E2FD1968489B79A5B63401AAD5D76C7ECE216D61
                                                                                                                                                                                                      SHA-256:073286DCD12BAB82FE98695C9BA2C477B1C3D693BBD269D49F1930E1D92F3F34
                                                                                                                                                                                                      SHA-512:A849D00B70AA8F8FB89D6E93F3E3AFC68996094EC450AE40DD19C643EBCC657FD14EE40B6548FEBA9F64FACDF43C0C10D36F17918FB1DE9589E9B41F4F6D1969
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.LQmlSe.~......u.vm7........9...H.1.E.Y.....]L4..'...C..?..%.,.".b`a1X...8$..c.]m{...{{.....'99'.9..9.]!?V.h.V)..]....J..x...Nr.6.Z..:...jU..0e.y...=.'.....O(..w.X.s.9.$Q.../.o..J.2l.....~..^\9SB..X......~.m.L...n.r.sD....'q..eX.....v.j...o.O=v...2,..~[..< z.8.9..*..=..!AAS[.....^..;?.....a\.K..<.........,....Ss.QS..2X...,.........8...7m.D..G$hS..%..............j..!.P#..-Bc*...C.M.'....."....;. [...I..s....y!.|.X.@..A..\)".0...W...p..;d..^d.f..5.]D..........g.kz..OO/....c...16..i.e+.r.J.4.+),]..3.....`.f3.~.iC.{'}o...E..A-"rZ.L...VM.{|....SJ.H..N.!...Jr...YY.j.D.....`......\.R"./.'.a3....J..N&h..,...#...........Z..@X..k...B4.AJ:....fE.U5.V.E.7@b.&..ws.7.f7PX....f..^o..m....Y.9##..X.C#.D0..[ g.=.{...NW...a....&7D.EV..s......!..@,.G4~.J&.Px.(N.<..L.........#{..[o.P...<`.w.. ...........B..y?l7|.....,.x...#G...`....8.+.{.y.b..R...P...=..ZW).N....Ee...o.........T.p...$.W...a.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\404.html (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):581
                                                                                                                                                                                                      Entropy (8bit):5.671194366055472
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:h4QW3tL6QcjWR0NNEXW0YWtRIkT4BkQiE4mT/qzRWh0M8pcPUvSsmNTAXaWmkoz9:hPg96QclfoxdGL8pccvSsmZ2bc16+AGb
                                                                                                                                                                                                      MD5:F14655D20C6A0F8F7689556EEDC6EC78
                                                                                                                                                                                                      SHA1:687EEA25A387F769FF4F276A44932373E0C18D21
                                                                                                                                                                                                      SHA-256:4BC05D51F81F548FEE56744D979AEB3782691F3172AFDBD7E9880A8C9AFF0551
                                                                                                                                                                                                      SHA-512:D4138FEE06B99C317B50EE13B4E921D17F84D357BA9EC595B352195156D4255E23A39A67D5FD59FBA75DABF59C9B54867522AA21C5CB5D6491AC0D7D0BA91D40
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta name="Keywords" content="......" />..<meta name="Description" content="......" />..<title>......</title>..<link href="style.css" rel="stylesheet" type="text/css">..</head>..<body>..<div class="bg404">...<p>............................</p>...<a href="#" onclick="window.external.wappCheckNet();" class="icon-1">........</a>...<a href="#" onclick="window.external.wappGoCurrentAppPath();" class="icon-2">.......</a>..</div> end bg404-->....</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):268
                                                                                                                                                                                                      Entropy (8bit):5.016387560591547
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x/XWVLAcVnT6NbUQ59KKY/JdstJUqW0JOLeRM3uV:JWVLAcN6bd59KKY/JutJQWsuV
                                                                                                                                                                                                      MD5:11153E7A49AC28AA0F6A5BC13B4155FF
                                                                                                                                                                                                      SHA1:4641F591FD8E31C8B00B231FA79B2700EC7A87CF
                                                                                                                                                                                                      SHA-256:3BC6D68B3423D29CB03D5CEC8E4FA2262D4A7DBAFC020A68520B8EA3A0E573BC
                                                                                                                                                                                                      SHA-512:14AC8011A89E86FEC6D24AA5DEF28AA616E49E6447C74E428A59D73BD894E7C36EAB9D2D89171E6C663D1536F6631B4431FCEA5791B2E3C7AF802A30893C2F1A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=12..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/selected.html..catch_img=back.jpg..width=780..height=508..frame=1..rclick=0..timeout=10..dialog=1..errorpage=404.html....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\bg404.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 779x480, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):14335
                                                                                                                                                                                                      Entropy (8bit):6.92934378343167
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:7UpzlnERXDNZSzCA8h+uSp5cbSfbHwjzVsZGq/Slh1XOQuytQZ4z:qh0XxZSzCt+v5ISbHov5OQM4z
                                                                                                                                                                                                      MD5:FAF8B6385FD7F996E95F05BD1F835895
                                                                                                                                                                                                      SHA1:DF57708B207CE7C482ACFE33898DF3CF12344B15
                                                                                                                                                                                                      SHA-256:611C3EBA62899A3A033CF9C0E120794E676EE574E161BB9CF35CFD02C47BCF96
                                                                                                                                                                                                      SHA-512:064F591A8DC156802867460D34D1B0B4887707227E83E5D693B1209911E18A205BA80DC6994DC876D217CD096935CE8C94790EFF0A068674B1D09186F105A3D9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......F.....)http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5684837B8A2111E1BE88852A1E825E74" xmpMM:DocumentID="xmp.did:5684837C8A2111E1BE88852A1E825E74"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:568483798A2111E1BE88852A1E825E74" stRef:documentID="xmp.did:5684837A8A2111E1BE88852A1E825E74"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\icon1.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 15 x 15, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1427
                                                                                                                                                                                                      Entropy (8bit):6.7017778396309815
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:e/1hpunQWwjx82lY2T32HEV/jdryJ3V/gKPcGc/drFnu9I63Wd7FTpt2STg9:eNitNn2VpZmJ3xgMc9dZnu99+pt2STg9
                                                                                                                                                                                                      MD5:3F70A66B5656E9B98EAB16B97AF4DCF1
                                                                                                                                                                                                      SHA1:FF8371FCE8A94F339A005E50EE56A94DBE6D34F3
                                                                                                                                                                                                      SHA-256:F554B18F74C318F1C83E0C83FB7C0EFDE426C96742FF4FCA788030FBDB690D32
                                                                                                                                                                                                      SHA-512:0963755D42F563463D182BA4342E632C0AB4F901ABBFF5AFBA528F4B11736CB745432850B2DAED4F649305E6203310ACE3A3B4F270440A3190393D6C80A780E7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............ex....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:85E7192B8A2111E19C57D1488CDA6081" xmpMM:DocumentID="xmp.did:85E7192C8A2111E19C57D1488CDA6081"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:85E719298A2111E19C57D1488CDA6081" stRef:documentID="xmp.did:85E7192A8A2111E19C57D1488CDA6081"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8.......PLTE...{{{................................zzz.........|||..................888.....///..................mmm555BB

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\icon2.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 15 x 16, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1341
                                                                                                                                                                                                      Entropy (8bit):6.660314282726688
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:D1hpunQWwjx82lY2T32HEVC4paKmFj8yJ3V+ZscKojGhL4zO/mnZ1D6I4Q:JitNn2VPpqFrJ3EZsiju4z+mnPmI4Q
                                                                                                                                                                                                      MD5:022049480A6EEA22446A57B2B48D6BC7
                                                                                                                                                                                                      SHA1:3385B067F1E663C28F777A96AE5957A7B574E9C5
                                                                                                                                                                                                      SHA-256:388A11AF4D1B8EDD9A3B4B0180A7FED9CF02B8F45385FCFFD4051C3D64CA146F
                                                                                                                                                                                                      SHA-512:81038C586AC241C120B00301B5DC744AFE90B059BD69600E90F140B3CB32693FEE68F312934262D3FAC3B4537E7B45D9D44520EEA3855DD674F30175AC9602CF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................6....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B4CBF35B8A2111E1BC3FAD68A8934BD7" xmpMM:DocumentID="xmp.did:B4CBF35C8A2111E1BC3FAD68A8934BD7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B4CBF3598A2111E1BC3FAD68A8934BD7" stRef:documentID="xmp.did:B4CBF35A8A2111E1BC3FAD68A8934BD7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...U....PLTE....................................aaa....................................................|||qqq@@@.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\star.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 71 x 30, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1460
                                                                                                                                                                                                      Entropy (8bit):6.710870562337673
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Uu1hpunQWwjx82lY2T32HEVL6oyJ3V8qGAHgHUu6BmiPDM1r+5Ckz:U0itNn2VwrJ3HnUt6BnPDe+5dz
                                                                                                                                                                                                      MD5:7094A805F02511F487BBB62E46730610
                                                                                                                                                                                                      SHA1:AD83885F1146A009925539715C2D944007990CF5
                                                                                                                                                                                                      SHA-256:2142EBCE84866039D63B991E0CAE2AE7A4DA7BB7A6696A9AA0C27970204F21E8
                                                                                                                                                                                                      SHA-512:A875C83E8FDDE33C1DF7310B4F840995C0FEFE493C4AEE42F462FF34C3A04A53F2134389CAAC2219C3F8FCAAE367F36DAE37D2D7403EC06D5D3CDC20B832A59D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...G.........I.......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D469F9978A0711E1A913CE9E06B5EE48" xmpMM:DocumentID="xmp.did:D469F9988A0711E1A913CE9E06B5EE48"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D469F9958A0711E1A913CE9E06B5EE48" stRef:documentID="xmp.did:D469F9968A0711E1A913CE9E06B5EE48"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...o....PLTE............xxx...uuu......}}}PPP........MMMzzz.....yt"{{{<3*..ooo..dddFFFJJJ...UUU~n"ttttd ___.....TTT.r

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):4.853209632444685
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:KDnYX6EGZ5XQV9WR6ZYL6GV5Er+QasB6l3Jrl2ABWgAtcYMEycxOwA4Au:KDnSdG0rWRB6GhUBIZRASYMQOlw
                                                                                                                                                                                                      MD5:77224A930D612CFA147269F5BBD2B2AE
                                                                                                                                                                                                      SHA1:4A199B46F400E43B8D92EB1347421486B7D2582E
                                                                                                                                                                                                      SHA-256:818BAE51AFDC6AB53F20962AC7333DE7ACA75B441D0C3D393E03E0B5E1DFF938
                                                                                                                                                                                                      SHA-512:C141B1F74C2F38B10A9B759BF21805E2E9AA925781599199F3F558C950EEEEAB1BDC13027524DD3C635044C7A6D005D848D835CF700C9ADBA1FD977721341297
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ........................................................................................................................................................................................................................!...;...K...H...:...)...........................................................................................................?...e...|.......p...Z...D...0... .............................................................k.;.k.i.k. ...................4..._.I2..^8..1.............y...l.6b..J...9i<.................................................k.}....&....u...k..g.K.......&...K......`...r...Q..k?..P6..)9..0U..Fq..\...U....8#.............................................l..W...Y...J...6....z...a...?sz..._%dQ.>...7..%....v...[..nC..ue.#cp.'[...Y...F.a.............................................l..b...l...M...F...C...2....^...=o.:...L..4..,..)..%.......f...S..rQ..hp..Kve.............................................m..b......._...D.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):773
                                                                                                                                                                                                      Entropy (8bit):7.695863552306289
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:37MFMYOphpgl8jMKuU7mTOSGvo6Ge8SU3ax:37YMXgDjQD8SLx
                                                                                                                                                                                                      MD5:C6D64D2E656C4B4BAB740F9B2E6BA71F
                                                                                                                                                                                                      SHA1:03930A6FC25F5509049DEBB5375CFFA29393057C
                                                                                                                                                                                                      SHA-256:6F4E916D0D8A96AFCE535FB2C72872CE85D4DAFFA230CFF432E64BD3FD92706E
                                                                                                                                                                                                      SHA-512:1523890264AAFA976A9214533B58697B88F807568B690023C32C4835828B28DF85EA397F2A529717C991341A74B89D917C6D89F8CA15E2BD0DEA98B05B493153
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMHTQ......S.F..tt....$EJ.Z$..D.h..p.").........m.Z."p..pQYi......4...y....)$..{..~.........l....J..V>.V........W...a.../..e...sc..S.66...............90w.e.{...o.Lj..r..k%4K.>.oW.!.K.....u..R........&..-f...@.fZ.y.!..+a..`.1XF.|L.l+8i.+..R..$B:.....!..=.._y..=..,/....E.`....#P...Z0....|z..O..E....E .,.:....^0*#...#._...T...*.'.o+.^....wW...PN.2..4 A...d2...l....q\.<.C(..4..\..N}g..{*v.J..=.S...h>..'Z....R...#.....Wml..X'..........^.ee!.d./......rQI..Zg.....J..].K...]&A]Fd..1-...u...:Nz. q.j..T..@.:..}...|....gmm.....6..mc..F...@Q]$.d0?3......U>......o..}...a:..."[Al..V..G.:DX|.|.W..L.y.ISYB./Rl.s...w.r.p.m ..m.i3]...W).1ddH....0.<.&..mV!....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\style.css (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2834
                                                                                                                                                                                                      Entropy (8bit):5.217757716871249
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:hAyEm4LVV2K+cxaxVvZt67x3aYM+j6AK5:hzETL72+wvZYx37Ms6A0
                                                                                                                                                                                                      MD5:DF8ACFDCBAAC70E85A66F54AD5A7CD28
                                                                                                                                                                                                      SHA1:48A82D1BAEA5458F328AA5FA91FA130DEC38B86B
                                                                                                                                                                                                      SHA-256:DC8C5BBF0CE53259F05D78EED3C7E389C78ED8F35EAE8184F5364824375DACBD
                                                                                                                                                                                                      SHA-512:686B80F9D58EBE22CC7C1C6FDAFB1BD7976B9BED194E9D184844DBA3D42A9B94195DB8EBA6D49828A97368F12461637866C2E7734AE10BD82B7313860FDA121C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:/*Reset*/..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0;}..body,button,input,textarea{font:14px/1.5 Tahoma,Helvetica,Arial,'......',sans-serif;}..ol,ul{list-style:none;}..h1,h2,h3,h4,h5,h6{font-size:100%;}..fieldset,img{border:0;vertical-align:top;}..table{border-collapse:collapse;border-spacing:0;}..address,caption,cite,code,dfn,em,th,var{font-weight:normal;font-style:normal;}..a{text-decoration:none;cursor:pointer;color:#fff;outline:none;}..a:hover{text-decoration:none;color:#fff;}..body{color:#fff;background:#2e2e2e;}...wrap,.bg404{ width:780px; height:481px; background:url(img/bg.jpg) no-repeat; margin:0 auto;}../*cover*/...cover{ float:left; width:310px; height:437px; overflow:hidden; margin:27px 0 0 18px; position:relative; display:inline;}...cover p{ padding:0 15px; height:82px; background:url(img/txtbg.png) no-repeat; position:absolute; bottom:0; left:0; _bottom:-1px; _background:#000; _filter:alpha(opacit

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\13\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):276
                                                                                                                                                                                                      Entropy (8bit):5.042940971137794
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xfmVLzGtZVnLJsNbUQ5TkHJKKY/HXVgXhXW0JOLe/sK:kVLStZVubd5TzKY/6XgWuK
                                                                                                                                                                                                      MD5:76BCFEB0BFB8B6BD8CEC28854FC4D42B
                                                                                                                                                                                                      SHA1:76AFA2BBA001887D10839624142FECFE61CEAB4D
                                                                                                                                                                                                      SHA-256:459231F45A31166C2E5B623A28B6D2AF95385ADFDE2E8B273FABC7BC9DDB442F
                                                                                                                                                                                                      SHA-512:60ABB38C8C3319DECD8C1742AD2501584B24479761A4F88FD6454300677B3DB5D601D03D8699F2689B662D1159AAFB5C5D4A6FEC4ADCD384FF7FCEE7C981742B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=102395759..version=1.0.0.1006..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/video/shipinhezi1.html..catch_img=back.jpg..width=920..height=700..frame=1..rclick=0..timeout=10..dialog=1..max=0..vscroll=0..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\13\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):5.282838979968636
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:T4a8bQsPGZYKQ36wejgyzSy+oYV+DMxZC5e1aaK6Ath2BcRy:TX80sP9Yl+/VlDcet6h2Ww
                                                                                                                                                                                                      MD5:C01D51842DAEE8580974E01879B235E3
                                                                                                                                                                                                      SHA1:70FBF395BE53B5AC089CE4D9EC253F49046EEA12
                                                                                                                                                                                                      SHA-256:7B062943DA7C2D5C5E327E280174AF39832FFB9C0DFDA4B54567980CD8E42663
                                                                                                                                                                                                      SHA-512:B5CC629A8F96F35DBEDC7A1DFC6AAFF743C739F395F294A1311F19E7C01CCB5EEE557DC5DE2C5C58B518F86479754E8A4A5034A6FEB2DCC69B306F2051454002
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ................................iLLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL....T........LLL.VVV.ZZZ.\\\.___.baa.edd.hgg.kjj.nmm.qpp.tss.vuu.xww.zyy.{zz.|{{.|{{.{zz.yxx.wvv.trr.poo.lkk.hgg.dcc.`__.\[[.VUU.LLL.........LLL.XXX.vvv.xxx.zzz.|{{.~~~.........................................................................~}}.{zz.xww.YXX.LLL.........LLL.XXX.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...O....v...r..=..V...Q...O...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...O

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\13\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):440
                                                                                                                                                                                                      Entropy (8bit):7.086005302182458
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72PGibjgYpQXmngdL75VfLfT+bmhPtN:qsv5gR5VfTk4z
                                                                                                                                                                                                      MD5:B9092CE8A3E15D256B74F3D613FDC3A3
                                                                                                                                                                                                      SHA1:AED3236B71F433E2711401DA6BE0DEB71BCE388A
                                                                                                                                                                                                      SHA-256:53690FBF4331D52E27306439966B46A592EFAA673E51A4F230A40C6385F1BCB8
                                                                                                                                                                                                      SHA-512:05D1BF69CC149906706298FD4486FAD200451D32D37005FA9437328423FAFC9BE42A520B978250F0D241F900B4E3EDEC1B55456C553513F5C61CF5EF5832876B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b...f...._.2.....DDD.122...I.....A.0.y.FK[[.a...(&.0>..'.........G......M.+....+..G..QQQ '1...0|.......D......U...@.aaa.....u.........w.^......L..l.@.......4>.....Y.........$G!.77.%.,0....(...2L\.......^...L..dbD..2......j2T..E.Q..........7...3L..a...@.#......+....0|....<N....>c.C......n...j..-...2..L...(. #3...>(/P.....xk.f..#.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 800 x 600, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):42976
                                                                                                                                                                                                      Entropy (8bit):7.976986096657465
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:JY8DOTs0tZu86QOBlrpSYZFOS7TW1jzoouQQObUTQHd9W:JnaI0tY86QOBhpqgyX9uQQO8id9W
                                                                                                                                                                                                      MD5:44F6139324A0D5BE1FEFC6AF9CFF9BF3
                                                                                                                                                                                                      SHA1:F564C49D243B598B6230F823E894A22C99AC6E30
                                                                                                                                                                                                      SHA-256:401FD43380FB9AE94E5E3D0C7C3FA5F663952AE1FFBA9F01EB019922B1EA9794
                                                                                                                                                                                                      SHA-512:AA302CA47AD77CCB566A57B19DE784FEFDA0241D36986CEBD19850F170ED7B1B8DEAF18D57ABE9FBBB8F871C5F1EC36C0BC96DA6249A95397E4A893EAA97E82F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR... ...X........'....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Y.%.u&V....nt7z#6B$@6(...H...5.=...F.....c".`{.:.~..!..m.~....$...o.....8#*$....!)......l. ......o...T....Yu.O.V....2O...2.,t...?v....A.P.UPw....{...(.!..j.]...Zd......e..Bgh..]...#V=.Pd<D.y....._..(;Z.(.f....-.M.GJT..U..p{.p.p...%........."..&{'.....6.....B............0...S*h;(8..w..V.c....,..N..]c.......b......Z.E.>@...L.ou..2..T.[W.jg..`a:....A'.....o{.'.P.;...c..=&.k-..zk^... X@#sG.>..F...tK.<]S;.@...ddu..1.. c...z..u..>.o.....5O.......U`.].0dn.7.....$../...f..0k....wB.o.`.,.%4.(.....fE&e..e.i.1.......].....B....N....z...<....+..K.HE+5...D.V...s.7@..i.TW.Y.#.......f......@......In....n.A...w.s..M.Q.~.kx..nr._..b;...V.v..)"_8n....V..h{.p}!.`.F...S.ik.Hn.7_T\.5M4..=.g....N...1..xb.l.W`.....T...[.tX.......tB!W.. X+.g....V.,z/Y..2.aUZ....*..eb.a.t..4._.p.}.V.d.i..+yq......m...ZU+o...._..L......lgm.v........t..L...mh.}......o*o..T.:l3... .(...E..:.?d......B...6..f..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):257
                                                                                                                                                                                                      Entropy (8bit):5.037816982032033
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xkouWVLVS1VnTkNNbUQ5WKCW5MKAX8VXW0JOLe8:iodVLVS1JQbd5zMK88UWG
                                                                                                                                                                                                      MD5:1AC97EB96E408FCA59220829D5F359DD
                                                                                                                                                                                                      SHA1:58839DE61AA3112519C29E69CEE87AD73D53555F
                                                                                                                                                                                                      SHA-256:A6A1580CA87A12E35774A2FA67A9DFCD6EDF905E7512C55D591EA10E66DC52DE
                                                                                                                                                                                                      SHA-512:D06127BCAB88EF19ED0C686219AF684AC552462661E399815E4E2863A1E74A5F2F3F695967EBA8F1B62409620937347AA7AB92EE67578F6AEF2C74326BB69882
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=102395754..version=1.0.0.1004..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/music/tingyinyue.html..catch_img=back.png..width=800..height=600..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):3.2550150789181798
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:kOsvGVoyywlkyy+PNkFl34XCXBq2kRMbZ1IIIIIIIIIIIID76rNU:kOKGVPPu54XCR8cGU
                                                                                                                                                                                                      MD5:77F7A0EC343EB8863C600A7DF658C29A
                                                                                                                                                                                                      SHA1:622E65827F7E0B1549811F884D0A5515D63B83F6
                                                                                                                                                                                                      SHA-256:B330B7064CD9A60146C6C18048A26E14642B4143E50F8173DFA0BFBB55628509
                                                                                                                                                                                                      SHA-512:3B41E06C47329D386C7CC959BD84166D619B16C91D2939615C5C3E43BF26B7DB3759B9DA7E0539DFE5D48FA08C745A62F40A2C19F8370FE1D266A51DA1195F7F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................................................................1.H.}7...@. .M...@..}7..1.H.................................................................................................}8. .N. .N. .N. .N. .N. .N. .N...:......................................P$u..?. .N. .N...?..P$u.............................e.. .O. .O. .O. .O. .O. .O. .O. .O. .O..j0...............................@. .O. .O. .O. .O. .O. .O...@...........................H.#.V.$.\.%.^.$.\.#.V.!.O.!.O.!.O.!.O...J..........................t3.!.O.!.O.!.O.!.O.!.O.!.O.!.O.!.O..l0..................... .R.'.g.).q.*.u.).q.'.g.$.Z.!.P.!.P.!.P.!.P.........................!.R.$.].%._.$.].#.W.!.P.!.P.!.P.!.P...J......................t=.+.z./..1../..+.z.'.h.#.W.!.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                      Entropy (8bit):7.410199232361714
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72QMpFzl013hVoss5uA8IFvxYU1I6FHrtoGAWh3:kMpFmGsm8IEUC6NtDh3
                                                                                                                                                                                                      MD5:9832AD31BB85BB3F6ED4A91F1758C968
                                                                                                                                                                                                      SHA1:5A78759E3A544619A60FF123450D7ECEB7ED9A12
                                                                                                                                                                                                      SHA-256:F64147F2D5DAE7DFB98776F24C45D4021329B6C264AE7308845C9F5DFC2631A0
                                                                                                                                                                                                      SHA-512:500659B62217099F29639D68BA391B51AFA62B216326E5E17BFE7C612AA62C964C2DB4A312507411087E9A16372469965C256BCE5F2D20B093E4AF376E006228
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.S;K.A......`....m..(..ZX....m,m........A.....&.H@%j ..<..s...u.pr&..t.c.....%B..........._.........@.T.Q..X<.]..<f*g(.V...+@%"{e*K...2........n..%f.m(P1...t.`...!............_.4..9.X..G0....h...z..\N.....o...T:h..u.......M....m;h2...mg..+...6.l....8.....U......Ay9U2.....=..."......g.tD:^}eT/...{.1 ..&.}a.{.S`.~TI...!..`_$.SY..].......&.........C.<....^{..;5M.Jf.C.o#..s...&_.[p...?......../W..V....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\Loading.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2012:09:26 14:27:43], progressive, precision 8, 717x671, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):16051
                                                                                                                                                                                                      Entropy (8bit):6.383750878137176
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:Vncibwy4Mjk8cirkn6JrYNMtKwrwLZS37ONYxdYmz1f2/TF51:VfH3/An6JrYNg7O4L1xdHix51
                                                                                                                                                                                                      MD5:EA53BE66F4F8D34176779A2DECB17306
                                                                                                                                                                                                      SHA1:AA20C6B8B45919CA45E9149A2787A46C2F4B1BD3
                                                                                                                                                                                                      SHA-256:FA2BA962CB670DA5ECD43312311C21BC493311B923468A214705DFAD4349F1AB
                                                                                                                                                                                                      SHA-512:5AB92127797CB510148C10E2B87A104C803806CE7CF7F683B0CD2F1450DDE4120471E8861C3272B701031E1B9961654FEE4B43E1B85F7B99FB00EAFC60D7BD9D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.....`Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2012:09:26 14:27:43...................................................................................&.(.................................*.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.O.B4.Y$.%J..I$...I%)$.IJI$.S....I$...I%)$.IJR.0S

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):310
                                                                                                                                                                                                      Entropy (8bit):5.107261797814054
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x82RcVLwSSVnGSDNNbUQ5joLD/MKpjJJLkn5LwvNzALwvW0LWERSyBStp:u2cVLwSSsSzbd5ULDEKp1Jk5UAbCSp
                                                                                                                                                                                                      MD5:792BE06C777E7289AA7743B3578EDFD8
                                                                                                                                                                                                      SHA1:102EB6C07CA71042345FC0E887F0DE1E59F293CE
                                                                                                                                                                                                      SHA-256:012199A9362834D304C490A4B87D306064994B45ED569DC904FA9719E96CDA57
                                                                                                                                                                                                      SHA-512:60A0E7538168CD5243CB16ADFB11D84949B3621C27D91F6548EB0E34A77C66A4DD5149521FE52201295BEACE09954D72526279D033508A34EF2509DE6FCB3CFE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=40000094..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/theme/index.html..catch_img=Loading.jpg..width=717..height=671..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..hide_share=1..dialog=1..NewWindowInIE=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5430
                                                                                                                                                                                                      Entropy (8bit):5.1820953247333605
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:MHUxOezcKDm7oTao7H5I/prMC+B9jmvn0SLBl+Qg4:qHkcKDP5kpot/jS0Us4
                                                                                                                                                                                                      MD5:447FEEE2F8BDA18A8FF699841D0B73D5
                                                                                                                                                                                                      SHA1:385C69F412FCC9F3A6979D4B0BC786C51B1C15C9
                                                                                                                                                                                                      SHA-256:9A0BBAB5E672AC9365F56BDF5C0FA4FAF69DCF80D08F0A7C8B622A72FA7540A2
                                                                                                                                                                                                      SHA-512:F4D6261CF727DEFF62D861053C6C8AA0D17283A0224D86859A325FDEDE36E3C1182FC4BC0B6504CBCD6027DE370A66EB156D4F2756E53D68D60C0BBE134A7C28
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:............ .h...&... .... .........(....... ..... ......................................................................................................{..XGV.R@O.N<L.L=K.^Ai.b=~.Y7..M5t.E6^.........................s=o.C0B.Q9P..\...l...N...;..h1..W1..E3...........................i.........|...e...K...=..~3..U1..SC...........................o..^..a..r...W...L...;...*...3..l^..............................X..E..?..h..\...:...+...'...y.............................k.N...D..C...F..A..kl..,...&.............................s..m....M...@...F..D..<..nE..)........~...P........j..................y....N..F..@...0..c=..(...#... .....8....M.3..............................N..8..r&..OP...........~...W..S.c.".8.[.....*...8...A...>...M......._....q:..6r..&....~......}..Z.n./.d.,.Y...U...a...b...I...i...w....~E..R..R.....8...........-....O...Q.f.g.Q]j.Jk..Jl............{...............................u{...4F=.p.z.....QaY.V.........:......................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3577
                                                                                                                                                                                                      Entropy (8bit):7.896644078371665
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/xYEIm73V60+:bSHIIHUCD4waL73V/+
                                                                                                                                                                                                      MD5:B12E3D6ACEBED86F40DFB4C894D24138
                                                                                                                                                                                                      SHA1:2768BCCD2F8ECF62BCD166CDEA53D5105B927C63
                                                                                                                                                                                                      SHA-256:72BD130D287CA9BC222BF22006CA9C7776838A664A3B8EAD5B061A6461F5C06A
                                                                                                                                                                                                      SHA-512:43506981ECB1ED3C3AD2C280777079E93EB7719F8A4A74688E2FCCB171850B9F2C31E218644E6C43A59A1A70C2F47B3490ED0EA0635D35975A6EFB9101AFCCBE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\back.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):622
                                                                                                                                                                                                      Entropy (8bit):7.566184431026209
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72r1s52jrOZBaFZgFnx5fCBOkOKtlZcT14kdqwJ7eNKyWZvsYSXmOT:31fuZMFZsx0BL3cqsnyWZvs/7T
                                                                                                                                                                                                      MD5:56AEE1C86D6256F465815579E5AD516D
                                                                                                                                                                                                      SHA1:6CF2FF2084E5695440F4C73A027545C2DE2CB533
                                                                                                                                                                                                      SHA-256:45AB4386467F1C6C692138C7352767F45AB341BA985CE0BAE3B685F0350E53AF
                                                                                                                                                                                                      SHA-512:BD304991D7EBAD9181ACD2C84FB32618E7BE35A69F1CF94289D2257F191917B6F43C9E68754E9D2102F31E86D380FDF4E58B29046EE543941F7BBEFAE35B7EE3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[o.0......nTm..RW.(H..T.....<...PT.^..V....ffr.E.,9J....7...r..@.?.s..s..hMS./#7....W<.na.F.F.....U.0...D....A...j.i.......dWk-..rl.~ .$..1]E'.&...']...z..x;?......Il..m..0.......e.-89ONLHpv<...}C...b!,,....i.8....f.....~......B..+zHy..o....#...x.X...y.....).'"....j....=.....N.~.<R...A...O..4T.(..F..Z.G.._s,.V.C........;......6...0e..9fG.l...F....F....w.....ShX.C*.....W.s...=/PQ..Kk.4Mq:5.ay... .6c..m..S.E*".M..`.!..^.O....= Nf..>..?'...{....8.....I..,H...r..$.......:...r.+.....eg...C.L..\.K....J6........IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):258
                                                                                                                                                                                                      Entropy (8bit):4.932198833574818
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x82xVLBHVnza/MKpjUeTVetLKwvNzALwvW0LWgvJv:u6VLdYEKpYeTstLLAbW
                                                                                                                                                                                                      MD5:CACD252CC23EC905A63DD8DC315219DE
                                                                                                                                                                                                      SHA1:34550B2838A26B8EA7301A5D1BDBEB9A16EC2782
                                                                                                                                                                                                      SHA-256:2FBAB88911F57D850191D2D76D612B41FFF7233026BB2AB96FC9A1AC0177A66D
                                                                                                                                                                                                      SHA-512:12F309EC5333628583516DCF0F57C871A3DB8175F7C4F84A23488060B776BD75BBB6E6E6AC4D8516106BDA02F013A046474B38F7C6A9FD6CAF352771B39D60F4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=40000097..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=index.html..catch_img=Loading.png..width=360..height=207..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..dialog=1..checkurl=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\index.html (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):861
                                                                                                                                                                                                      Entropy (8bit):5.4660632914667096
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPO9kQDbu7SGOL8orwtzzrdgCN0/oa3GCK6TqSByA+iY/PQEfjxvnfjL07THT8:hP8Z2jOwJtzP7ittHTdeiY/hfjNfjET8
                                                                                                                                                                                                      MD5:D94F9DFD6BE72C13357CD4312E29CF2A
                                                                                                                                                                                                      SHA1:E72A49B866693FF8F779161149D61424EDFFA85A
                                                                                                                                                                                                      SHA-256:2FF30F56322FA11D365FF77998E7B3982E5869BCB7B01254828C8814DDBECA55
                                                                                                                                                                                                      SHA-512:D4D76B4A49CCB21AFAE413FE07214F7CA2CAFCFB9929A27FF5E0260C14E80FE08C31FE6150B57D5FFAEA5C62461AAFA7B48B90FD0CAFBCD05385446F861BEC2A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html dir="ltr" lang="zh-CN">..<head>..<meta charset="UTF-8" />..<title>....</title>..<link rel="stylesheet" href="http://s0.qhimg.com/st.360.cn/;bk_up;style/7e995a0e.css" />..<meta name="description" content="" />..</head>..<body>..<div id="doc">...<div id="bd">....<table width="100%">.....<tr>......<td height="107"><p>"<script>document.write(external.wappGetSystemInfo("updatetitle"));</script>" ..............</p></td>.....</tr>....</table>...</div>...<div id="ft">....<div class="progress">.....<div class="val" style="width:60%;"></div>....</div>....<div class="btns">.....<ul class="clearfix">......<li class="s0"><a href="#" onclick="window.external.wappAppUpdate(1)"></a></li>......<li class="s1"><a href="#" onclick="window.external.wappAppUpdate(2)"></a></li>.....</ul>....</div>...</div>..</div>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):850
                                                                                                                                                                                                      Entropy (8bit):7.609811882129263
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:n0gD0BgZzVm/Wuf/c7CqKYPpVZ5jewEAQ26Nozw9:nfm/kChuHn16qk9
                                                                                                                                                                                                      MD5:0F4BA1A40C2EA13A402470EB81C8C59D
                                                                                                                                                                                                      SHA1:CCCE59BC5713AE2859611EFD1D030059CA09F3F8
                                                                                                                                                                                                      SHA-256:B1307EA4979EB106609D48A429641E9AD125BA8B7F8DCF2E46815DF3F83E2364
                                                                                                                                                                                                      SHA-512:0EF7CD9B7CEDFF638BD02BFB07FD7AF133D23E32CDD42693FCE5968AAA23C81D35BD0B46949DA562B166D3C152F5E8E4117326785CDD7C851E5D9A84A787866B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tIME.....+.Q.?.....tEXtSoftware.GLDPNG ver 3.4q.......tpNGGLD3....J.).....gAMA......a.....IDATx...{HSq....cZ...X..cj.....V.. ..P.J.%0....J.L.a.D..f(..9..AR..)...;.,.nS.......\~...Kd?W..~6u".`.hn.(..p$.......T.Dw.....#.A...}.'C|.E{..01..4..*P..95s....x..\..?....$I9.<.~.7.C.&....kb3.1.........~.....C...|(.]i;..:...k.5.$..k$!.q@...0o-.....O...Y..{=.,.rj.../-.g...m.T<@t...*8...3....gx=.1-.k..5.zP..+RGQ...B....x..p..p#.!...@.jcM_`..vn.*..$...@........e...C.{..._.`~.K.7L.@tW(.....m.....E.,.....T.....@.g.c...&.A..Cl..R.-.T.<....X...-y...C....i....".'.......:2.W.<.;f`.%..._.?M.`......a.....ks.:7@.f..6.X.K.0...30..c..&L....J1.z..6....0.].J...n..H..x<...c....4...$.5g....y".p..:.....Y.......+..X.n.Zg+L...P..R....0*.&.q..;`..._....d...Z.:9...%X,....6...?.Lo....\N..3M.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\back.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):620
                                                                                                                                                                                                      Entropy (8bit):3.72647716480673
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:Q+i/avYu/LwDeGti8PTpKAAtpKD9v4Avr+HKvmQSHQB5HlblYZl6Ya8DoDvZhSaK:Q+JvYu/LGeGZdKAAbKD9vNqKvmm5jYe4
                                                                                                                                                                                                      MD5:5E8605184EA5C11692EA7C7BADCC9605
                                                                                                                                                                                                      SHA1:97C4A0F2E615896AEC01A8B639FFF7D19D3E2E4C
                                                                                                                                                                                                      SHA-256:0B50ABD35242ED5AC75BAF159BBF4E3273BFA9B8F9B33E5DDD0CDC13DFB119A2
                                                                                                                                                                                                      SHA-512:A979EA89016B61E31787C476FA1C9998CAE4E87BD6976371666145DF822A75EC11E8AB42C15CC39BE772280D6FBB4C7B525E8543A75F68E984C3F1D5395171C3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.8.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.3.6.0..[hQLhb..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=..N.e.f.^..R....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.6.3.0.....h.e.i.g.h.t.=.4.8.6.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 16x16, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):6.631924571015197
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:jSnZcun+bvWCQ0NSxZdWoGtvH7/lF9PjZgBr3DPmRkLT4z:uZX+bk9WoUflNEr3zmRu+
                                                                                                                                                                                                      MD5:2A5907C09D75152D099621F1D40D7A04
                                                                                                                                                                                                      SHA1:779D93041CD0DBED5DEA3E4B4D315081FEAF586F
                                                                                                                                                                                                      SHA-256:ED874B0C638C1B4517A5E9EE21EFDD75DDD0F33CD6B2458F49C42333237778F8
                                                                                                                                                                                                      SHA-512:017B60B926D0B6AFB85C18EE2EDE125064754BFFB4E8A4A0460FEF88913DE3FD78F40E80CFDAC993F1AF8A945E8C35A71BFB426862E94BB278BC9D437AF87769
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6......... .h....%.. .... .....F*..(...0...`..... ......%................................F0..F...H..I..L..N..N..R..T..U..X..Z..\.._..a..c..e..g..h..h..g..g..g..h..f..e..c..b.._..\..Z..V..T..S..P..N..L..I..H..G..F...F0......................Eg..F..I...K...K...L...M...M...O...P...R...U...W...Y...Z...\...]...`...b...a...a...b...b...b...`...`..._...]...\...Y...W...V...S...Q...P...N...M...L...J...J...I...I...G..Gh..............Gh..G...J...L...L...M...M...O...O...P...Q...Q...T...V...W...X...Y...Z...\...\...]...^...^...^...^...\...\...[...Z...Y...X...V...U...T...R...Q...P...N...N...N...M...M...L...K...J...Hh......H-..H..K...L...N...N...O...P...Q...R...T...T...U...V...W...X...Y...Y...Z...Z...Y...W...Y...Y...X...X...X...W...Y...Z...Y...Y...W...V...V...U...U...T...S...Q...P...P...O...N...M...M...J..J...I...K...N...P...P...Q...T...U..!V..!W.. W.."Z.."Z.."Z..#\.."[..!\..![...Y.. Z..$e..'i..(g..)k..)k..)k..&l..%i..!`...Y.. Z..![.."[.."Z..#

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1791
                                                                                                                                                                                                      Entropy (8bit):7.282304314952082
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:QWHNn2qJXfIJ3JVJUkijyl8B5/UTvLoV5Gm:lt2GPsVJUk7M/vGm
                                                                                                                                                                                                      MD5:0C20581BF63BBD796E3D0B4B21BA9C76
                                                                                                                                                                                                      SHA1:8AE895DEE318A5F13D0647C289DD92DAB97010DE
                                                                                                                                                                                                      SHA-256:7782439597273E15F56453C0E20AA444F94E10845EECA9F5185ACDD5E03CCD22
                                                                                                                                                                                                      SHA-512:FC5D085F45B9D028614CB072C9C0D8AF6D7F25881CA79699927604F2CA7FB701AF9A671797EEE63115302B53D47014BF393BB127A79239162A8F607EC0D99C8C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7877C08B225511E2811BAB4F0B0366DE" xmpMM:DocumentID="xmp.did:7877C08C225511E2811BAB4F0B0366DE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7877C089225511E2811BAB4F0B0366DE" stRef:documentID="xmp.did:7877C08A225511E2811BAB4F0B0366DE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.`X....}IDATx...Kh\U.....{g.Lf:yL..6.I5.....E"]....T.W.V.A.Eu..#X\....Bh.h.VP...6)I.XC.4...$.d.7s..}zz.p.8....O.l03.h.JuD#Z.(

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41000017\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):263
                                                                                                                                                                                                      Entropy (8bit):5.059450475202175
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xrmVLl9ySVnFyDNNbUQ5/UyRZRMKY/JXmBgRXW0JOLe8:1mVLl0Sezbd5syRZ+KY/JXmVWG
                                                                                                                                                                                                      MD5:7F9B5752950F1B4FBE18F1D413078179
                                                                                                                                                                                                      SHA1:E2ADF90F718E886C0C46B0DADA852351E494D82B
                                                                                                                                                                                                      SHA-256:29A569803B2DFC63B96D0177E4824BFDED2EA9B176E779D47C3ECACAE35323F8
                                                                                                                                                                                                      SHA-512:A3E7F55CB9544F2CFB86F68402FDFDB10A2BDBEB323ABD1DE83E7D2B5FAC12380CD5B276FFF6A2E66FC131D7F811EA01B42E0141643DCC5A0B027DBD0DA22684
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41000017..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/ertong/ertongleyuan.html..catch_img=back.jpg..width=724..height=512..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41000017\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):5.272865555733899
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:YiWvOO6OOOOOOVdMHgggggeIK333P33333333wHHHH8HHHHHHHHB+cDXfchshfcS:vcOO6OOOOOOLMHgggggeIK333P33333P
                                                                                                                                                                                                      MD5:FA4C0871F09256E78A8572E0465BC1ED
                                                                                                                                                                                                      SHA1:FC79A4B2F9CDD30F34859B8008E9C00AC25BC7B2
                                                                                                                                                                                                      SHA-256:34C607A83BB9E1A3B152DB6C8ABDF5B6495032FC18B6EFF35EE1C435CE756591
                                                                                                                                                                                                      SHA-512:EAF558A1CDA73C57A3E546BEA105A08B4ED7D7B035DF8C2A089023973C0338B2B49E4B722C0B7FE93A42954F93220E59C754858956282724ADEEC1576153056D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................y .l..j..j..j..j..l..n..r..v...y...z...z...z...z..v..r..p..m..j..j..j..j..i...r..iC..........................C..A..B..B..B..B..B..D..F..M..O..N..N..N..N..N..H..E..B..B..B..B..B..B..;...\.........................[...W...X...X...X...X...X...X...X..._...\...X...X...X...[...c...X...X...X...X...X...X...X...X...X...z...........................>...'...)...)...)...(...(...(...(...........}...M...z...........(...(...(...(...(...(...(...(...(...f...........................F.../...0...1...1...1...1...1...1....@.....b.....d..z...&.1...1...1...1...1...1...1...1...1...l...........................C.......1...0...1.../.../.../.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41000017\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):616
                                                                                                                                                                                                      Entropy (8bit):7.530477633466423
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72rokRmxkKU4RWmbiGIL9HXQFqsPxMRQhK9aebj8idjW:3okMkgqv2m/bhjW
                                                                                                                                                                                                      MD5:5CED58E294927112F3AFCAB5B3F65B84
                                                                                                                                                                                                      SHA1:EE8C0D989018997F7E7E8A3C8275A2C65DC9CF70
                                                                                                                                                                                                      SHA-256:E92FCB0FF36E4B879719DC86C041A0976C8233214CAA87A3C9523580D6F163FE
                                                                                                                                                                                                      SHA-512:76BE2FAC5893C5F04F70032CA7C82EBCD7207291D34D68243FCE752D9039587F97E27D16BF7E43C9DBD9384EED18BEDD514D054FA85077F06D10152BA076DAE6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMLSA......`.6.*.#....HB=..I9....r..s....$..../..C..W!.J.R.1........U1...By..;.{.%..F;.dfgg..fv.....C..~......._...S...4R.3..s.Z`.._p..p.b=k~...j..v3.2.|.}5.q .W1...3......,..as..........=k....^...e....&+i.A..i..".k..4Q&......~...5.....2Pu..#*{....D..Q$...*...e..U..l......;...P8H..T..2 ..a.X.#....d`...bL.I.Sr=.I(,.....(e......Z...pAn4v.V.....;.U......4..N#.e+.....)x.g......].8I.X..-c....Od4......k.....V.#. T.B0..H.)B.@*...umO:...v}.....f...p...........a).FU...\...ln....U..P>|<H.+y..o...y..}...K....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):317
                                                                                                                                                                                                      Entropy (8bit):4.935266667855842
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xEVVLhraVngYtrpNbUQ5nrD0oMKAX8VXzALysqcs57Jwyn:4VLhW+03bd5mK88FA7srt
                                                                                                                                                                                                      MD5:FB13058ECC9F1005547A1C11DF46628A
                                                                                                                                                                                                      SHA1:68B173CE3001210495879BB466DF942100C638F3
                                                                                                                                                                                                      SHA-256:0EE7BA429BC05BAE10A5B86410215361A9A191939DDD8094E85B2CE6D72A88B8
                                                                                                                                                                                                      SHA-512:23AEBF934F36FF1A3297FBE4D306F2C35FC1E6CA4884142E5B8E37A5801B0750A79FE8B9E01992FF5FAE19A6390E170595F12A194D669372824B6E4D448485BB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010001..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/social.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.1467555087668435
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/aKppe79frIPm+ZqhcTxFFFhp05qnU684m1eyPxakpDJnyC:icqfrICcT7U684msKakjH
                                                                                                                                                                                                      MD5:A4934622B853F2D0558B8810E0C24446
                                                                                                                                                                                                      SHA1:42662FC3F946988969854932471C79381C5E57AD
                                                                                                                                                                                                      SHA-256:B993933B9225C5476FA687F8F4A1D08465F3D198C36B761B10B76F58CE0E4FAD
                                                                                                                                                                                                      SHA-512:C5D1724DDEA8BE0882DD55B0E1FA61EE8DFE10A65CB838D2888156F9DAE6F2DDF7D6C58A6A3B4C0C337D86B1E7A9CE1483C32FEE6F7EDAC9D34554C431166C0A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................be^5hn_\io`Xio`Yjq`Xkr`XGo`XCoaX.haY.haY.iaX.jaY.kaY.laY.laY.j`Y.iaY.n`Y.e`Y.W`X.]`X.X`X.I_X.X`X.l`Y.L_X.:^..........................:...:...;...8...9..'@..+F..5N..;T..@Z..B_..Ca..Cb..Cb..B_..@\..:R..6M..2H..0C..*9..'7..)6..(0..&4...........................3..0M..0M..,H..!5...0...2..#9..(<..+A..&A..$@...J...H..-H..'C...;..&>..%9..$6...0..."...-..)C..*C..,F...!...................... 4..0M..-K..9N....y.w|..x.........S.....hq..fm........M...z.go..T[........K...{.ou..Zb....v.LM..#B..)@...!......................$9..1M..-L..5K.............................................................................WW.. =..'@...&.....................(%<..0L...M..-D.............................................................................."4(.(C..-H.........................2&=../L..-L..=R..............................................................................!5'.*F..*D...0.....................=(@..0L..$?..4>...............

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1719
                                                                                                                                                                                                      Entropy (8bit):7.252548529152065
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEV88yJ3V1aMbgSG1bVahoNN282Vn5ZrMq1lzkaBUgvy5:JwqNn2SqJ37iScbVz282rycFCMjM
                                                                                                                                                                                                      MD5:D3243F717AE59CF6FD7FB321481427F1
                                                                                                                                                                                                      SHA1:5E78AF0327B7E2DCF4B863C1C149B04ECD0E8537
                                                                                                                                                                                                      SHA-256:8AF0DF0967C780179FC269B318EF7DF3CFF75ACC2D8AF05CD55F43E4D902B49A
                                                                                                                                                                                                      SHA-512:A737EAC13EE0E43F9F42E522148F5EE5E45A8BFD35DAF18E531A9D521B1A217FF392E7D3EF6A8B5D0713CA6D2433B94BAA802485D4E041000350ED8C0ED2E2A1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DD2CEA94FE5211E1B530976CD51ECF8E" xmpMM:DocumentID="xmp.did:DD2CEA95FE5211E1B530976CD51ECF8E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DD2CEA92FE5211E1B530976CD51ECF8E" stRef:documentID="xmp.did:DD2CEA93FE5211E1B530976CD51ECF8E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>rS.....+IDATx.4S.o.D..f..]{7q...I.P(=...*@... .;*.#.O.....Q/9!q.!q..Is U....I..........b......7.1=..I`}...k ....n

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.950785833444288
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x4xVLH9VnJLKNbUQ5nnGKAX8VXzALysqcs57Jwyn:mVLH9zLKbd5nGK88FA7srt
                                                                                                                                                                                                      MD5:197E49C70C1EBF512A341E66AE824536
                                                                                                                                                                                                      SHA1:7593D5F3EE7375DA9B0CE7755569AC6DEBEBA7B6
                                                                                                                                                                                                      SHA-256:C27090AF8896DCDF6B3C59EBC486629426DD9532C00558B6081540FBA6856C20
                                                                                                                                                                                                      SHA-512:E9349BF6572CC3C7FBD13C17EA08FAA922517C1B030150F8065507A8CC1F1B7583DB0E405FBEF80955F92BCA3323D516820D7BB39FD9D2C32FB2A2E1B45C4CAA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010003..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/music.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.383412945466849
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:NPQjaRVJsbeyPJdA5eB6R4qkb3W0KgoIf34wvpkJs2kn:NoG1sbeyPJSeBVqS3W0KOf34wvpkJsF
                                                                                                                                                                                                      MD5:FC5B6A6E3EF44C5D19DC10876796EDB8
                                                                                                                                                                                                      SHA1:5139116462D20F03248FFB07202D86DDC10E66D5
                                                                                                                                                                                                      SHA-256:5ECFD31E8DF7784BFE3ED70AAE1E7F6D0AAF08A1E322FF20D07D34B5442A511A
                                                                                                                                                                                                      SHA-512:65433A7C12B63B349B13460C2751D3A5D31266D1B1087D5DF188BE5E01276FB887C6E189EC1D5A3D82A20BA073D42C3738916DEF288853165256DF15F7240A73
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..................................?{.f..g...g...g...g...g...g...g...g...h...i...i...i...i...i...i...i...h...g...g...g...g...g...g...g...d...r...*.........z!..]...g...g...g...g...g...g...h...i...j...k...l...m...m...m...m...m...l...k...j...h...g...g...g...g...g...g...c...]...+.:a.b...h...g...g...g...g...h...i...k...m...n...o...p...q...q...q...q...q...p...o...n...l...j...h...h...g...g...g...g...d...r...a..g...g...g...g...g...h...i...j...i...k...o...s...u...v...v...v...v...v...u...s...r...p...n...l...j...h...g...g...g...g...d..g...g...g...g...g...h...i...h...b...Y...Z...f...q...x...{...|...|...|...{...z...x...v...s...q...o...m...j...h...g...g...g...g...g...g...g...g...h...j...k...c...Q...V...W...Q...d...y......................}...{...x...u...s...p...m...j...h...g...g...g...g...g...g...h...j...n...m...`...t............l...s.....................~...}...{...z...v...s...p...m...j...h...g...g...g...g...g...i...l...p...l....0...........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):770
                                                                                                                                                                                                      Entropy (8bit):7.667667994524824
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:3aJ6Olfe4ojDeEwAZGoOXXJgwPEPvd6MYnE7:3glfe4ojDAAZ5g3MPlsE7
                                                                                                                                                                                                      MD5:8E73320DEA64E756C67D9C2469C3DDE9
                                                                                                                                                                                                      SHA1:D03EA57695890D7F4C735790AAACB7BDB41FBE76
                                                                                                                                                                                                      SHA-256:BB19792B94FBA34825A7C87B097A6FC1A215F13F6BA03A5C99011DC3BD523C09
                                                                                                                                                                                                      SHA-512:C47C93F47898E155EB91070325EB3212A8F05DC298DEA340B9124FABC4DC266BBAF88CB519C9C5E6A274423B05E5DD1205DB1320302937CA5AFC0E5FB5BF5931
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.dS?k.A.}3;{..\L..".Q..........`....".[....@l. .4. i4ELa.1...g0w{......^.p.....y......=....Nf.GR.8.....;.s0.k7/.|(...-.....7Q.........2...DU.Uq..S.RBF.CB.~...d.....3.".T.....`r.G...r.,..[02aL.y.......Ou..#+...w4...E...13Z.....6S<_."...Db...9.U..8.df.pv(.....4...s.htn...8.,b...]... C..p..k..+05R..:.zx....N..i"A.+7h.5Z...'A..t.....$...!.?.pD.SB.:.0..."..{r.PA..t^../.....'9P...`..1..-..r...S.E.AN.3.G..O.0w..m.c.cO...rX$......(..>..9..=U.v+g.RB.M.e...$g..@...........n..P..6..q.o..Q.6.EL.D.cz..9h...lA.V...~p...V...f.$.CQz.....GK...[.~Dm...p.........!.>.#p....T..../..h.V.].$.iV..P.,.;..........cC......$.EO..y R..4;..Z.%Rl..|.G........Dh....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.956344065029536
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xFWWVL/3Vn2NbUQ5nx5D+KAX8VXzALysqcs57Jwyn:3WWVL/3kbd5xwK88FA7srt
                                                                                                                                                                                                      MD5:877D7A2229337FC4B8F1BD42D959C2E2
                                                                                                                                                                                                      SHA1:962552190B139A59859B20BBF889676810203B90
                                                                                                                                                                                                      SHA-256:6F5D4CD8817A6B1A1E3FDCDBD3D4AB8F3A6B0137673F0DD839D3B7B3C9D0420D
                                                                                                                                                                                                      SHA-512:135DCC9DB8B2F1ABCCC8D6D9BFEFA1607A1D8AF8B64ED404C65F91E29200875A1D3BBADA647BA4C81FE0300BE364CB4DE5EDAC0B7859DFC3FA83291F9171A3B0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010004..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/video.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.525345605079403
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:oPgMlyfRfa3dPrS4msSfiVb1XASV2JVQTpX7y2NMCkD16AhEw+:TftatzS4mWZ1ASVIYpryQMCm+
                                                                                                                                                                                                      MD5:EE102FF1CC30D49E1EE94C957716A2F7
                                                                                                                                                                                                      SHA1:588455F5CAC8C600F9C109A8A9D36B04F12380A3
                                                                                                                                                                                                      SHA-256:D40F7483D0C9F5E99BBBA486788FD26F2CE850B4F4F0105B1C0340FB709FEFBC
                                                                                                                                                                                                      SHA-512:D0150E41BDDD0154A0B275337470AD0C61F0E54B915B733F40DE7E0D7EEBD7AC435D0C787B7EB6D4BC1B7658DB6F5B546D4DC59E8BC0DE72328F18F12ACBFD82
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ....................................#...1...0...0...0...0...1...0...0.../.......-.../..20..,0..,0..+0..#/..%0.."/...5...f...o...9...-.......0......................B..(Z.."T..$X..%[..'b..(j..+n..+t../z../.../...5...1...0...3~../|..1x..-r..*l..-i..+b..*`..)`..%[..$Z..&^....................#.*c..(k..(j..,n..+q..,u..*y..*}..(...,.../...)...-.../...0.../...-...+...+...,|..-y...x..,u..-r..*p..$k..(r...C..................%]..&c..,h../k..0l..1o..0r..-s..1x..;..$>}.!>...2.......2...3...1...0z../w../t../r../p..0n..1n../m..'h..$l...H................@.)b..*e..+f..)e..%d..%d..#c..#e..,s..+j...K..(c. 9|..3...%r..'s..*s..)m..*n..(k..(i..&g..'d..(g..+k..(i..'k...N................L.(c..*g..+h.."a...\...\...Z...[..!f..#`...D...H...P..,h..2p..$g...d...c..._...a..._...^..._...a..&g..'j..'l...N................Y.'d..+j..+g.."b..._...^...]...^..#d..#\...A...I...M...H...N..-b..1m...`..._...b...`...a..!c.."f..&k..(i..'m...V................b..i..,i..,i..#e...d...c...`...`..&

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3610
                                                                                                                                                                                                      Entropy (8bit):7.899292397711389
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/x6CuF4wgXk5Ic:bSHIIHUCD4waneSX4
                                                                                                                                                                                                      MD5:E78F57089427AA783749018543B1DA19
                                                                                                                                                                                                      SHA1:84C16B13CFE2F9B5F7ECA7BF3AD60CBC2C2BC1B6
                                                                                                                                                                                                      SHA-256:2287C37DFBDF981D6D24CF8E7B36D4AE3804D57629F28259B4F4987B4AE178BC
                                                                                                                                                                                                      SHA-512:DC11BDA55793E119B4A3E44D34B62C8805D929ED4B3155557AEFD97713F1738D1D44012B08FABA842498FAA4B697E79722EA97180BF6429A43D860061F39BB52
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                                      Entropy (8bit):4.9604710228149305
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x+VLqVnwX6NbUQ5n+MKAX8VXzALysqcs57Jwyn:MVLqnbd5+MK88FA7srt
                                                                                                                                                                                                      MD5:2808B6DD4F7D159D33D74AE710CE861D
                                                                                                                                                                                                      SHA1:B307A1327BE1420E183E1DEBAC4458F1885FCDA6
                                                                                                                                                                                                      SHA-256:88875896DDEEB7CFA205D20E29E9CB0B05EFE3848C9F8621DF3AB2335077A48A
                                                                                                                                                                                                      SHA-512:DE5DF30B2547F719403185531638A906C0EFAFB5B578BB3915412A7DCDF39715DE71E56BD3B036CEC6117178D489B1F9D2FF98B2E6643E1839B3177D74A0E6FE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010005..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/game.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.7310533928540135
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:Ig/FymEUfarNgg9pL91r8HlJjzE0137O0SIVTyr0KmTzo3VSTI0h:htxZOR8vI0d7O0Sw40NPTH
                                                                                                                                                                                                      MD5:3026ADAD9B11A1B6351FA78E74DDF068
                                                                                                                                                                                                      SHA1:FDCDF989FE0B230FD19A2E677E9AEBC971FE1F2E
                                                                                                                                                                                                      SHA-256:1EEBAA6B02555CDC06EA3AA1A7F1E88D19B660F33FB9EFBD2B06941D526541E8
                                                                                                                                                                                                      SHA-512:4F93AFC8D1B6826B1A74B3226773A142BB149F7873310F551B4C4D9DD357FACB20295AA763CEE62B8E4D6AB179DC5DBD856FC2A87C79EE31EE963D4D66D30058
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................Kl..Mv..Ai..Ju..)Xs..[~.!i..#j..#i..$k..(k..&i..%g..'i..'j..'h..&j..&k..%l..$k..#j.."j...b..,]{.Sx..Ho..U|..Gh..#%)*........!8E:r...w...}...i...K...d...................................................................h...\...t...........j...2GUM........'=KFz...x...}...q...J...c...................................................................Z...K...y...........}....5GW........(?OR............x...N...d...}...{...{...|...............................................|..._...O...~................2Ce........&=Kb............z...A{..?w..S...W...X...X...W...W...Z...[...]...\...]...]...[...[..._...^...L...F...}...............0FWu........,CSq............x...I...P...]...\...[...Z...Z...Z...Y...Z...[...Z...Y...Z...Y...Z...Y...Y...J...D...{...............9Tf.........5Rd.............u...R...w...................................................................e...N...x...............Ef{.........;Zn.w...........t...F..._...v...{...~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1013
                                                                                                                                                                                                      Entropy (8bit):7.737474544663215
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:7VnREjP+laJQEMkbGCbcZtIQ9D/Q0AMfak6:7VnREjPOLkb3batIQV4VGak6
                                                                                                                                                                                                      MD5:6C28A3D7F88C672AA3C3DDF1C71AB537
                                                                                                                                                                                                      SHA1:0B556894375739F5C9767D1E10DDD80FF25346DC
                                                                                                                                                                                                      SHA-256:B0B0FDD805CDD8C3A3A6167C6D3A328B5A8BCF08E75AA4B623B0D234E9A194E5
                                                                                                                                                                                                      SHA-512:597BA016011013A5F0CA26EBB25986DD1F023E946934871F92E109EEAEB8A42A51E11DB5483DE9EAB2B099A381F5A4D784274DFAAD0911B1A01CF346AEC212AC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.$..o.e.....$~&vb.q..p...Vm.B.. TT.Y..JT."....e.....,Z.BH,..]d.J..BE.8Q.fLL....{f.......s..!nqp..../p..-H.Wq}}...{/...g...?8V...G.P.......!|.h.a.}...@$y....).Y...'.......K.~Q1..Z.^.*..._..L_....~.m..8.aF.x.l..t}k.............OQ.;.W6.F..s..Rj9[6.... .&.Y.......;7..vAk^._...:........y....M2%7"....G._V.m..ML...J.n...w.pq9......G..F.p...sh~.9.....I..@....g...g..1.O..<f.{..jbP.Q.T.d.5....[............~..j...."34kj..^..@m$..G..+.Y$#S.*.....&.'.....#..t....K.p........0w....x.U.xgH..L.#/.A..!..I...x&....C|.......N...... 2.@..c/..K...4..'pi...mp.H.l.O*.I......g.BWm.K.`wj..>....tCWE....C0.0..F..Um ......i].\.|...........A.....3.S0...V.t@:.....q....Pa..R.v~...vW..h..D.s.D......}..F.#`s...5.............E.s..-.c...88n.....S......5X..i..l...J..-[.cp.9...C.3.s.c..v..Q.Q$..`.e..i......i46..wAt. .....A....{..%../.U.g.Z.Ig7..|H...v...\!..NP.......U...*.U...T.W.......o.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                                      Entropy (8bit):4.959938568668223
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xpVL/ehSVnYDNNbUQ5nmMKAX8VXzALysqcs57Jwyn:jVL/iSuzbd5mMK88FA7srt
                                                                                                                                                                                                      MD5:00431EF627E9B40E7B50C3586657D098
                                                                                                                                                                                                      SHA1:806C0F23726DA7A8DCE625AB8981DB2549D8838A
                                                                                                                                                                                                      SHA-256:39AFC8AD2F4ED178F5156862AEE0037FE410D84919AB6D3C588CC18A38820CD9
                                                                                                                                                                                                      SHA-512:A83A0AEE5C834A05CE2C34EF8445A6D67CCC92B98A4B6029ECA9475667D8D88773F4E58BE3D8914B104A5A2E81E3E1F3C206689E64D6264086EF7C1761F917F3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010006..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/life.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.123923091383425
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:GUREDVOEUKU+ptPitr73rYbRuaYN65w2d1x16T2/mt05I+s:GUNEUKU0hur774RGN63Xo9
                                                                                                                                                                                                      MD5:BC39369552A83C4605FB197B6D4E076F
                                                                                                                                                                                                      SHA1:227D9F5AEAFC9A58B3EA8382214122D6603263D7
                                                                                                                                                                                                      SHA-256:688E832FE0C40A7CF4E5195EF9CB36914B1FABA99DE324B7865BCA2F43C686F5
                                                                                                                                                                                                      SHA-512:F29CDEBDFD15522853A27F5D266008CFAA1BF72C43D522F9B9AB70B54E69B3227B755AE212F2156EAA391651E323E6DA80BD1157DBEB0149AC6081754F30D648
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................|||.............wwwy___=]]]<^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=___=___=^^^=[[[<kkkA.......................................e.............................................................................................................S...........q...................................................................................................................a...........{...................................................................................................................l...............................................................d...[...t......................................................w.......................................................9.n.B.k.}.......`.~.*.^.m..................................................................................................".c.........................:.h.R.......................................................................................a.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1690
                                                                                                                                                                                                      Entropy (8bit):7.272208627759569
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVFLeT3yJ3VCLuG2dif/lXIrlss8t8Ig3XGi8/t/UYAieL9:QWHNn2qfaiJ3KuAJIt2WXGDV/4VLDwI7
                                                                                                                                                                                                      MD5:9DB9DB4903D7E1AD0B26FD00F63982D6
                                                                                                                                                                                                      SHA1:F5B1C5095D946DFD0C98EB143CD17F01E17B4377
                                                                                                                                                                                                      SHA-256:686A61AF03640B0BAEB5946D06F3A0E5D0E146F767429B76EE5733D0F9D1A116
                                                                                                                                                                                                      SHA-512:CDF363DCCAD5D997253DB4F1B53FD07B0B19332DFFD5EC4FD868768EED497A3C4A5AFDAC7E00982E011184074F5760BBF22391BA95AB5EA3CBE56799F4552F6F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:FAB7FA9FFE5311E18FAB9597E2C2E77B" xmpMM:DocumentID="xmp.did:FAB7FAA0FE5311E18FAB9597E2C2E77B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FAB7FA9DFE5311E18FAB9597E2C2E77B" stRef:documentID="xmp.did:FAB7FA9EFE5311E18FAB9597E2C2E77B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.8]8....IDATx.$S.o.E.........(.s..v.( AG..4!.H..h..P!Q ...R.?AtiR.....$......r..K..........f..f..........-.|G.....?xy....r.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                                      Entropy (8bit):4.96354868738225
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xTVLuXVnIkNNbUQ5npWp0oMKAX8VXzALysqcs57Jwyn:5VLuXSQbd5pNZK88FA7srt
                                                                                                                                                                                                      MD5:C044B9480270FB60A72E994D7CFBBC0B
                                                                                                                                                                                                      SHA1:76001BC99F03C05C9C10326DA9D04F4E5E4D1E5E
                                                                                                                                                                                                      SHA-256:69FCA65D70DE780130CD6416B4332138E465035EE966FD52D8955646C6A7767A
                                                                                                                                                                                                      SHA-512:076ED3587BAB4FF6FEBC7F9D54D74A1A37B885162E939B26388810421EB811C75B7F78F51BDCEFABC214B517952FFA13EBBF08B9391571F7871DB4A4FC1A5BF1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010008..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/fashion.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.664757497114004
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:Ms5EgVHimUP2rbGknnpF6UuVoE1mRVY7uV8fSNWYfhl8/FJ0+6AN:t7Hn/rbGMpkUuV6zYuuSNWYir0+D
                                                                                                                                                                                                      MD5:F023EC5F28C4652DE4EB7997B7B2125F
                                                                                                                                                                                                      SHA1:D20156CC75F64EC63A9C4086308714E6FFB5FF31
                                                                                                                                                                                                      SHA-256:1E395B7D62ABF73CBDD83FF9DA0FA125C29C330998F04B8F8E31911F88F1B43B
                                                                                                                                                                                                      SHA-512:6514396B8DFE68C5340C13389F11A5C0DA7A1B5EB8A97AA9CD8C8BE1403FFCD9262F2AAAB22E8B548F3116C33233DFBD7105BB7FC8E92622CD4925C86C8EF8C2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................``a8...s...p...oxr}oy_.k~a.i~b.j|d.j.e.i.f.i.g.i~h.i.g.i.g.i.g.h~g.i.f.i.e.i{d.i|c.i~a.iy_.jxp.p...r...p...s`_a<................/0/......~..lV{.O.~._...i...e...`...n...t...l...i...x...y...l...k...s...p...b...c...h..._...O...kP|..x......FEH.................X^T.....s$..y ..x(...+.......2...6...9...;...=...>...?...>...?...=...:...7...5...0...-...+..x&..y!..y*..........???.............dp]..P..z....1...5...3...4...7...9...<...=...@...A...@...?...>...=...;...;...8...6...2...0.../...0..."...T......MLL.............F:P.v&..w...y...t...............}...........................................................w...x...y...y&..ZJd................,.Z.l...w...t...n...............u...............|...........................{...~...........q...r...v...m...*.Y................:.m.t...~...v...r...............|...............~...........................................v...v...{...s...7.k..#..........,B.x.z.......{...z.................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1827
                                                                                                                                                                                                      Entropy (8bit):7.3468622709312745
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:JwqNn2SJXatJ3E65j2WfLnVbZ9Hd4zGlvpkr:12h2gbDHdO
                                                                                                                                                                                                      MD5:FB6F20EC94D8F6620BC4813CFD21E07C
                                                                                                                                                                                                      SHA1:C9330A96AC7CBD4C30A7C67EBD96763339FBB23B
                                                                                                                                                                                                      SHA-256:504FA6DBF57662A4F6AD692981E0772EDAF516D577DC9C73F0FF4BA856ACD8A1
                                                                                                                                                                                                      SHA-512:3E1655C6B1DBECBF46F6842FAA0006F3E719651DDEDEFFA0C707412A5FD7BE07B1E97B915A1B16B0F5FD7625FD6CC91268470EACFDDCB5FC8B800B1264439105
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:EFA7C054FE5211E195E3932ABDA7E579" xmpMM:DocumentID="xmp.did:EFA7C055FE5211E195E3932ABDA7E579"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EFA7C052FE5211E195E3932ABDA7E579" stRef:documentID="xmp.did:EFA7C053FE5211E195E3932ABDA7E579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Q]O\U.].s..;.03.P....".$...hS..T.....}3......&&&.'}3Qb....T..M..%B....3..0_...8.x.a...v...4..?Z..3

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.962132144658908
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xixVL7rVnmNbUQ5nlMKAX8VXzALysqcs57Jwyn:cxVL/0bd5lMK88FA7srt
                                                                                                                                                                                                      MD5:46ED24D9C05D2FF8C25F2514E71AC4DE
                                                                                                                                                                                                      SHA1:12862A40DAEBD9D306D88E903E355A298EDA55CF
                                                                                                                                                                                                      SHA-256:4D8522BC9D0F4667943DD00526F6317E533F8E9D11F9459AF03B646C26D127A8
                                                                                                                                                                                                      SHA-512:C0C42E208EB9A781565A66D4B25432BAE452D0F2F7C26491809D2AE9823659F6520D03040535EDEF50B298D08C53371AB736B8FC220BE81F278BE4F37CD45D2E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010009..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/tools.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):4.950724673411782
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:6LRdUSYknCN8AC88mHmjOZahs1JDlg3rl15tz8wnSQ3h0YoDoWSsiu0mtb7AqwCH:1TknCYjbjggoar7z8wSY0TrScspL6
                                                                                                                                                                                                      MD5:5ECDCCB9FC99BD54FAFA7B66AAFA8E98
                                                                                                                                                                                                      SHA1:4864F297BECCFA356E0C4BD52E7957A5DAC30E61
                                                                                                                                                                                                      SHA-256:EEA96B28EC5B0004E0728D9C633C428287C64D80D6D65984B2DA5A38EB064B91
                                                                                                                                                                                                      SHA-512:059634684795CB0B16E37188AFE3858A6DDFEF4B89F83BEB120FDF9B8C5E145C81C5A8F54B26B75D87162E5D2BCE9ECC0134D2E9B7842C2471EFADA2B6BB8512
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .............................8;?.%..k#..v"..s"..s...s...s%..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s%..s...s...s!..s!..s!..t"..x3Ta2............1Si@............................................................................................................&...............*WnG............................................................................................................................#_{K............................................................................................................ ................j.W.............................................................................................................................s.a................................3..............................................................................................g....................................................).........................................................................s..................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1573
                                                                                                                                                                                                      Entropy (8bit):7.156172199592931
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVz/BoyJ3V8peGY2x8Ewb7RQH9wTdMxCKiInW8oOPh9+P:QWHNn2qHrJ3yeJE8f72i6v3f5JUP
                                                                                                                                                                                                      MD5:839BED271E6C514A5D2EB7B71E6D4B11
                                                                                                                                                                                                      SHA1:97B4D4D8178C0E92A47DF236EE8B9067E6E0474E
                                                                                                                                                                                                      SHA-256:3D927AA49B006349F65C5D17CECFDB7B0066367F768ADE0A70A3C0D34EDC0E90
                                                                                                                                                                                                      SHA-512:4496DE05F886E7D0EBC066C5F69AF30D84D180517C9A4ECB4C445389106B7B8E6E53985EBC4296D99DE2A1A5828EDFF30C5610494FCB98E0D7AC21417C67FC21
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:00C3D49FFE5411E18077E37066175716" xmpMM:DocumentID="xmp.did:00C3D4A0FE5411E18077E37066175716"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00C3D49DFE5411E18077E37066175716" stRef:documentID="xmp.did:00C3D49EFE5411E18077E37066175716"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..az....IDATx.L..j.Q...s..W..t.T..[..J-Y...P....@....gP..+..+..,.m.....6.6.$.u.w...~.;.s..Qj..,....T7P.g..?.Y.XaP.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.949950243042386
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xkmVLeVnBqKNbUQ5nfI5MKAX8VXzALysqcs57Jwyn:ymVLe3qKbd5jK88FA7srt
                                                                                                                                                                                                      MD5:26312D153000D2C2F383C0F630E64E15
                                                                                                                                                                                                      SHA1:9FD24B4EACD050A4242F8C18A2F94FC1BE9E2B04
                                                                                                                                                                                                      SHA-256:2EAC776D15900830F6E53E15E6FE876DDDCE8E6AB0B247AA47DB1E7180905CD1
                                                                                                                                                                                                      SHA-512:9F24BA99E85909F9C6A106D9A12365C525FF6537DFF525B081859DC901495FCA204B5961EA201D685FC31C31BAB848443AEFC958CDAB3038B2E34E4B541B9B58
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010011..version=1.0.0.1001..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/mini/novel.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1150
                                                                                                                                                                                                      Entropy (8bit):6.696759280646044
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:WWxaAbGln2PbNPx4vHfGd89oDpMZvf6Rbqr:WWx/c4wvHfs86DpMZvfqA
                                                                                                                                                                                                      MD5:1C4DCAC9F552D56878D4A52FCAC1A7DF
                                                                                                                                                                                                      SHA1:F188EF7E761D206FD1274AAE2F05431C012B3B81
                                                                                                                                                                                                      SHA-256:4272C8895326A053B5DB012715BE6E925DEAC6C5686B385E231DB02A3E95D41B
                                                                                                                                                                                                      SHA-512:949584652F9EF91ACACCE97D616F8D183F0D2AEC7ABDEB659F3E24DFFBA06D3F2EF83F503D87379FAF7EE32F5C48256F2B8564CA6CF4163D22014B97091FC1EA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:............ .h.......(....... ..... .....@...................1[hZd{p.bT0.XY?.<h...>...9..6\}.*My..4z.)R..8h...3y..=..E.../W[/<q|.vQ..yM..{H..**R...........p...p.......s..${..........@..1ipJ7^a.wP..uT..|J..-%N......"....u...t..@...&~...|..#...$...3..0juS9UQ.s\(.ee8..K..,$R..B...>....z...x..?...(.......(...P...;.."HQaC[T.r_..clC..K..)%^..I...B..."....{..e...@.......)...d...<..%N[oM_S.vf8.`{\..L..&&g..R...L...(.......W...=.......-...q...=...ct{UdU.zb/.hqH..O..$(r..N...H...0..."...Z...@.......0...Y...9..+bz.]jZ.`..}o/..P..!+}..A...?...6...&...<...1...!...2...K...9..#Tn.ry\.w.......a...4...W...S...D...%...?...3.......8...S...D..%Y|.s{R./...;..e...8..2h..0c...I...5..:R..$;.......H..9l...K...V..l............}n.PH|.........F\..............................0c..s...............l|..........`r..............[x..............Gfjt(<AK........................Uv......................................s......................Jx..x.......................Q|..........(8=%Ioxrn..............)K..>l.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):992
                                                                                                                                                                                                      Entropy (8bit):7.7713387585355544
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:A0BZmIxT556WHubIfgZwEt0Frl/S29T3WjvNepc:feilcfIfI/ErlS2VOei
                                                                                                                                                                                                      MD5:844DDCA1D925E71E9B64DD39EF95735C
                                                                                                                                                                                                      SHA1:12B52B95064E670B5C0DD0C1AAD4E1850537791D
                                                                                                                                                                                                      SHA-256:4FE063A8E4F55F31B647CF4EAA29B3C1C77642A912582DAE0C7687133EF5CF2E
                                                                                                                                                                                                      SHA-512:2573314F71A0F1DB258C34C9517C12710A32D60D83EEC7DAA15536D6EDC3B7136FAA7256D9DEF79BD1724C8A8D400695850BD04CCEF1AF55922BB9F5897DCACA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..SKh.U.=....y%3..$d.4..ABq..%R..@.)Yt%j.RQ.n...]Ku.. ..U.......J...j.G......u..v...{............"?.Cz 6v...c.....6.F.rc......~[..]..Z.z.\j..$.H.......+K.g_-=3.88:5l...w.|..xqh..w.D....{.[[{.w.V....kW....;..........."..P.D...#.(...g)K.".:.+....&....pb}..>.|..rb.....Q...).........*....3.Y...........#C..}...o3.G......K..A{^.~Q)..Rf.AsH....?..{..*U.....3'.w..;...pe]....yNM...V.#...."........}G..el....<8io.c._..OT.Q.._.o`..1."Q....:......*&.c.x..y....)..I...O.Q.L84....6".4y.n.C2..B.ohQ$.-.._....3][.5?.."...f+K..*U]e.......8........Eh.{....R.B?G].h...'-..P....Ip.Hj"..!.q...n.&..Q.:.R.C/a......%.&.65..$.F.T...._J.8$.-0b.......e.2......@..W.X..n.X.....|.......r-...=F...5...E......6P(...y..Y.C.^]>.....r+.c\.5... ......~...Hb$..J..q..-S.L.3.....9.M4:.mz.a;..>H.i...0......t....`..g i>0V...G..W.Q2..tdP..'!....(...Q.I.'....T6..I....QU.S}........... .....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                                      Entropy (8bit):5.025645351265841
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xiovVVLHS9VnawDmNNbUQ5nuMKAX8VXzALysqcs57Jwyn:5VVLy9PDmPbd5uMK88FA7srt
                                                                                                                                                                                                      MD5:D4E12D133CE4E63D87FDE596EDAC6D7E
                                                                                                                                                                                                      SHA1:B433F4E9765670DAFCDCB9A6CB2FD7698AAE393B
                                                                                                                                                                                                      SHA-256:9406E9933AC0D54302654482A0DA93ED7981E11C93E6D890CB591CB5542F4FF8
                                                                                                                                                                                                      SHA-512:216AF6837F4DB96E5E0CAD0F0C5965AEC7156EA0CC4BFB7046D156BF8C8C19BE18290C6EDC6CEBF4C7B1D9C2216A2DA51DE6A5B4B1091D7944CB70217F636DFC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=102395752..version=1.0.0.1002..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/picture.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):5.306748975761254
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:j/ezRWrNDg/nHfXMw/IQUr7jR3yIflOnxjSROQjhZ:j2VW5DSfXMyUH1llO8RBjhZ
                                                                                                                                                                                                      MD5:39F1AF5D20B5FA3BD8A9446A08E3F6A8
                                                                                                                                                                                                      SHA1:5070BA1EE5D7D3596977B8E6B7C38CF12B492C16
                                                                                                                                                                                                      SHA-256:50D0F6832BA9490B64C43EAF5EFDCC5F8D5641616047DD6065ECE79B0EBDC3F1
                                                                                                                                                                                                      SHA-512:8BFC8F7526C01ED99668996BBF1439B6AF0DC72FF6A4702BF234B4DBC1F72B0DACBE71510F2BF84092DA820D228303D6A3CD582FFD73D61DADCA86C08E534A5B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...I...S...T...T...T...T...T...T...S...S...S...S...S...S...T...T...T...T...S...U...U...U...V...W...W...W...U...S...T...T...T...T...T...T...M...4..........................................."...^..................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1707
                                                                                                                                                                                                      Entropy (8bit):7.290497360373356
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:QWHNn2qUfJ3r/3B+p8WjcGE1g/gmj2ggbLC0Y7:lt23h/3B+pdTE1gPj2ggbO57
                                                                                                                                                                                                      MD5:16F57A2638753B17F72DEFABE38E53CF
                                                                                                                                                                                                      SHA1:78D7687CAE55FBC059FA2AD6BBFD97B3567B3122
                                                                                                                                                                                                      SHA-256:A5A4143320D633EDB78AEFA71F585888D58EBB1DDF6F6CFD20A61749B1523486
                                                                                                                                                                                                      SHA-512:3C3973196D100CC8CE279C40F6A8C8FD7954FA89EB77AC655C2E174279534A2A4E02E13AD5DA2E64415B40459170A0EAFE2F13BA6C07B755766BE297C0150E45
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7BB909554FE811E292EF98C5F7C4FE29" xmpMM:DocumentID="xmp.did:7BB909564FE811E292EF98C5F7C4FE29"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BB909534FE811E292EF98C5F7C4FE29" stRef:documentID="xmp.did:7BB909544FE811E292EF98C5F7C4FE29"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..vV...)IDATx..MLTW........g`.....7"...B.h...&M.....6.&..n.B.&.%a.6iH.IjR.M.5.q.`.# 0.....y.....E.'...'.s.....,..........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):321
                                                                                                                                                                                                      Entropy (8bit):4.9662771090398525
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xVxVL0SXBVnXXKNbUQ5nVKKAX8VXzALysqcs57Jwyn:VVLJB1Kbd5EK88FA7srt
                                                                                                                                                                                                      MD5:4720DA30ACD35F7061A009BF12097431
                                                                                                                                                                                                      SHA1:4458795E744C92A6D3891AEBF0A0716896E8957E
                                                                                                                                                                                                      SHA-256:423B5D3027D9F7F47168244DA4DEE695B2FC330C11E11BD622660FF199BE6D65
                                                                                                                                                                                                      SHA-512:DCF023B0D3A2F4B550F0204BBADC7D74350F81035593C77361880635BAD00A4BC3AC03BF05688C7D0EDB240983C65892B964FB7582A004605417D3DD1E5449C9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010013..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/investment.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):5.800853721893965
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:haFaj+hpA4r/fcuLM2iji5PS6QHKcE9JvIHxJgFqsZXQFETuPDUvdsjd5w+XkG7J:h+Q+h+C/M2hQHKvfgsZXAIvCjMOkG7q0
                                                                                                                                                                                                      MD5:1D03B03E28B1F81EA1B58CE87A667E07
                                                                                                                                                                                                      SHA1:D98DE8B7B172475982EDB9EAC227AAB77A08A17A
                                                                                                                                                                                                      SHA-256:197E99F7DB21D5776B92F4D1420174B98D82B1F5EAB25D3D9946B802D4885727
                                                                                                                                                                                                      SHA-512:914A503E060FB6FB2A6A99705477B2955B460C0B4AF80182C9E1EBD21A337C89A2A242AFE9769BDD29448DCD8430FE5809EFD412DB4245CBA53E8C4162C0B6B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................B..,._..^..Y..Z..Z..\..]..^..`..b..c..d..e..f..f..e..d..c..a.._..^..\..[..Z..Z..`..X..P/.!............O".J.q...f..._...a...a...b...c...e...g...i...j...l...m...n...m...m...l...j...h...f...d...c...a...a...`...g...i..X4.6............U%.U.o...b...]...^...]..._...`...a...c...d...f...h...h...i...i...h...g...e...d...b...a..._...^...^...^...d...f..Z5.8............V&.U.o...b...\...b...e...\..._...`...b...d...f...g...h...i...i...h...g...e...d...b...`..._...^...^...^...c...g..^7.<............\).c.p...b...P...L...d...h...^...`...c...e...l...l...i...j...j...i...h...g...d...c...a..._...^...^...^...b...j..g<.N............`+.h.p...a...S...E...J...b...k...a...e..._...\...o...r...j...k...k...j...n...j...c...c...a...`...^...^...a...j..i=.Q............b,.l.p...`...`...W...I...L...b...p...a...X...X...]...r...w...m...n...h...a...q...m...d...c...b...`..._...`...l..rB.Z............m2...p..._...^...b...\...N...Q...`

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1676
                                                                                                                                                                                                      Entropy (8bit):7.212829335167512
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVKwfyJ3VF5G54o6B+DJtHQdHecKMdPP1oOGtVvvhPaq:JwqNn2SvKJ3d0bL2+viPyO6Pa05d
                                                                                                                                                                                                      MD5:9CD270D5DD770AAC24E31A354622B6F3
                                                                                                                                                                                                      SHA1:556EB8862702CE14A365BDAEBEB37B7B8BB8BB2B
                                                                                                                                                                                                      SHA-256:E3A5419CAF661070EC8FAA0B2104CDE36A278B788829DA077CBA1E68F3794A34
                                                                                                                                                                                                      SHA-512:8511232D87EEAA380F22B6683F2F1A4C78F2D7F0D5D91F6633A7BAB793B07EA80F6A40E46E43F17B9281C35D791C6AC8B48120F914C88CB5B509625C501C088E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:020B3D84FE5311E1AED0CEE83748DAC3" xmpMM:DocumentID="xmp.did:020B3D85FE5311E1AED0CEE83748DAC3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:020B3D82FE5311E1AED0CEE83748DAC3" stRef:documentID="xmp.did:020B3D83FE5311E1AED0CEE83748DAC3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,..F....IDATx.$R;l.W.=.3;.k{m....e..AB2."D.(...!. Q.@.D.M..iRP.KK.&..R.....!..l......^........4zs.=....?..@.....j.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                                      Entropy (8bit):4.967324401143455
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x9WVLdVnSuYNNbUQ5n2m9mMKAX8VXzALysqcs57Jwyn:yVLdcuYPbd52m9mMK88FA7srt
                                                                                                                                                                                                      MD5:2A0E5B9F974C4CF0F01B6B916FD959B6
                                                                                                                                                                                                      SHA1:60CA4EB38BCFBA4DA1AAB07BF964642B0878FA0C
                                                                                                                                                                                                      SHA-256:08594A9454BE5376EAF97020DFFC1497A147CC0CDAB6D7C4A1ECF04F0E86B4BD
                                                                                                                                                                                                      SHA-512:E054BB158849E7C6596E8AE0B7CF641C21CF2D5211388E6DF1ED2935282889C7F5162B15EFA50E6B2FDFD98BB3ECA15BD62999DC78C665282AB36B1B54B2BE0A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010018..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/shopping.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.244375588470727
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:80oBnFFn1dAxOLarnebhRA+vMUvu5PZvuagihZNZv9XXgoFs2tiOCfnzP6oe9nd:8TdT1exOurneVtEUyyyNngoFH8nT6zd
                                                                                                                                                                                                      MD5:39C449DFD4172C8FEF4D79D8F3ECF019
                                                                                                                                                                                                      SHA1:B76585CD211E0BD19328FFB6A6BA306BC6245C4F
                                                                                                                                                                                                      SHA-256:C0FF5EEA0BFF68D6A67AA730C16E704AF401CF5A60E5DEB7BD56E791F0A7F78C
                                                                                                                                                                                                      SHA-512:B2C8BAA61223A3A995CC9827B1F8134A77594109495040081D399FE49391D56297A7E23DE71216537C747E068407A59147C6E41E35A8D5B1442E0AA7D0A44D00
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................&...6...>...C...G...I...M...P...S...W ..X"..\#..\#..`%..]$..]#..Y"..Z!..T...S...M...L...H...F...A...;...4.....l.................aN.-.p.2.x.5.}.8...8...;...;...>...>...@...A...F...@...D...D...A...?...>...=...;...:...7...8...5.|.1.u.,.m..9..................S...o...{...........................................|..z..........................................v...o...6aa.................U...u.......................................}..........................................................n...:ol................(B...e...................................e.......q..5.u.<.~.y..v..n...............................}...[../sn.............. .:Q...r...............................i.......g..%.c.+.n.&.i.!.`.l..w..s...............................h...>................$#FY...|...........................x..........8.r.k..=.|.#.b.\..C...~..p...............................s...C.................-Qd.............................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1754
                                                                                                                                                                                                      Entropy (8bit):7.285789734958503
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:JwqNn2S2J3rJvlpu22AjzCy5bOONHYkW5tLbZ:12Z62lzCiNHYkWTbZ
                                                                                                                                                                                                      MD5:D4C8F1DF118F8FC64AA4DDDC31F29697
                                                                                                                                                                                                      SHA1:7AE57827226012EE65A4893A8070A9775F28A084
                                                                                                                                                                                                      SHA-256:6B6F88BADF77410D370E663BC2B3980C1C48FBD52BAF156D86673EFB7F88D213
                                                                                                                                                                                                      SHA-512:6B20F93F7213C37EFB1F684FAE64F115A32DED84108E42A54FD5A55ABB80DA87DB68C5CFE60460388F18DB3B359964B06635C6F0E1BB2500CB38431A0077A1DC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:CA5BDE84FE5211E181C6F1422FB0459B" xmpMM:DocumentID="xmp.did:CA5BDE85FE5211E181C6F1422FB0459B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CA5BDE82FE5211E181C6F1422FB0459B" stRef:documentID="xmp.did:CA5BDE83FE5211E181C6F1422FB0459B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>9......NIDATx.d.;l.U...y...........$2....XD...........$$...@"4H....&.H)(....$H....;q0.........w.:.tns...9..+e..{......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                                      Entropy (8bit):4.9686066710509476
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xViVVLZVnkJNNbUQ5nVlL9MKAX8VXzALysqcs57Jwyn:oVLZ6Pbd5Vl5MK88FA7srt
                                                                                                                                                                                                      MD5:183747990356B87208C54FE122A7AD2C
                                                                                                                                                                                                      SHA1:4296A5E0BB5B62A4E973E67CEB590484654332FB
                                                                                                                                                                                                      SHA-256:94AED96FF80D2052397990FADAC17F56F2E2F810F39A9A20157D2AF7F44A7278
                                                                                                                                                                                                      SHA-512:F70453499C91806D3DDEB64CDC24DBDD222C8E7BDDE7BA24BF6E893A4494CFA184A4A3DC1DBE8D0583A2A79C4A8444B8113F6A0271150853F142468EEB2C7849
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020002..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/news.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.502356981324228
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:KeCgIIwzEW5T4AN+8afhZ1tT6wVPIaCs0LH2AmW:KerIIwzBT4ANnar18wVPxqLWAD
                                                                                                                                                                                                      MD5:D476ABA8D99BBF39C7CA914BBF30DD35
                                                                                                                                                                                                      SHA1:5DF2375B3EBA919244D26A00E78DCA264A4C076D
                                                                                                                                                                                                      SHA-256:93EF9FB51A4142EC5407799A0048ADE165E3EA335B2179BBE7E2B0917EB56858
                                                                                                                                                                                                      SHA-512:664D6771A0B74BBE57C490ECB790B9C0CF1881367B13BF5E74DCE939D39E30C804A2755FA9C52D83F562958764C5B2C946A14AA13F2A4C3466EEADC7029F1DD3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................................................................................................................................................Cs..7h..<k..An..Ao..Du..Fw..I{..P...W...Z...]...\...\...Y...X...S...M}..K{..Gw..Du..@r..<r..;n..<m..7l..?s.Y....................-Z..5\..9e..?h..Ck..Mu..T}..`...l...t...~...................}...q...k...`...T...Mw..Bn..?m..;i..7e...]../g......................2]..Ck..Iq..Mw..P}..W..._...j...r...x...........................v...q...g...^...X...P}..P}..Jw..Ep..<h..2j......................6a..Jq..Qz..W...Y...^...c...l...u...y.......................}...u...t...n...b..._...Y...Y...S...Ny..Bo..4j......................:d..Rv..X..._...a...d...f...n...He..+DY.[}......^...'CV.Gg..~...e....FX.5Ri.b...f...a...a...Z...T~..Hs..6j......................=e..V{..]...d...g...j...l...f...%@S..0A.9Yr.....Ee...7H.Hi..}...Z}...9J.0Of.g...j...h...e..._...W...Mw..7k..?r..................=e..W~.._...g...k...m...k...p.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1747
                                                                                                                                                                                                      Entropy (8bit):7.285774204678194
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVQlKFyJ3VagAqGdqIWoT3gmDRaLhXN5JXK3bmZ00dUO:JwqNn2SuJ3VPIWq3aLFN5U3bmHKdC//
                                                                                                                                                                                                      MD5:571AF2707D1147E42B208A5B98F98BDE
                                                                                                                                                                                                      SHA1:38E75672641FC4C836EDBF11473C362B8729363B
                                                                                                                                                                                                      SHA-256:2F22D05B68B3A16479AE3D04686E2E422A8E734D1A26B2FCDC2A795979E8C832
                                                                                                                                                                                                      SHA-512:F073602044EEDC1FDD1F05EB0E5B71284A392FC88C2692AA5C40A2E67CDFFD2647DE00A998A0E5D131C30744EA9820604280EE492E6699C6652AE0B4E7B23DF8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:1877BFD4FE5311E1B6A8F56F97B9BCDF" xmpMM:DocumentID="xmp.did:1877BFD5FE5311E1B6A8F56F97B9BCDF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1877BFD2FE5311E1B6A8F56F97B9BCDF" stRef:documentID="xmp.did:1877BFD3FE5311E1B6A8F56F97B9BCDF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..?....GIDATx.4RMh\U.=.}..7?.L'.dL...*...R*. .....E....u....].(.u.R.*"BH.A.U.$N.4...y....K...{..s...03d./8y......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):326
                                                                                                                                                                                                      Entropy (8bit):5.047002109476319
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xV4VL9zKVnCKNbUQ5n/ky9MKAX8VXzALysqcs57Jwyn:8VLwUKbd5/tMK88FA7srt
                                                                                                                                                                                                      MD5:B3010D5013CE394490FDD675EACFFEE1
                                                                                                                                                                                                      SHA1:980A80543CF558C5B9C95E8B193DD1D27A2553CA
                                                                                                                                                                                                      SHA-256:EF20DB1DE1250B46ACB32D5C1CE97F085FD67AFA421CF6F2DE6CD1F3A2042542
                                                                                                                                                                                                      SHA-512:ADF00AE70CE375C535EDF3ACC7CEB48353B856A2F1D326E1D79A36EC9C72DCB486BA9DCAF4BA9DDAFC9637CEF4A22FE12D170C3EA0B636425AF6D506AF286B32
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020006..version=1.0.0.1001..name=..............[AppSetting]..icon=logo.png..smicon=logo.ico..title=............url=http://static.apc.360.cn/cms/mini/magzine.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.306713577547797
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:UM0mIfogLvt1rp5q0afKkwCrzT6vwXiZESw:UM0x/D7rDqFSNCrzT68
                                                                                                                                                                                                      MD5:3F913DE1863481A1EB2D4400DF2981F1
                                                                                                                                                                                                      SHA1:DDE8678AC1DDFEF0A6EE438CF4BF32E7B6274C63
                                                                                                                                                                                                      SHA-256:5F5A309335670B3B63147D061C5C4523A656A43B44E9FD6BC5B77B057D76DA08
                                                                                                                                                                                                      SHA-512:0F71EBAA314E6D7B62F90B463F466832678388E59E5AECFC46259400E0696E2DD24404CB51A57211EF6D838CACC04FDF820ED1CDBD23768525B8B44BE3E342CD
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................FFF/rrr.ppp.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.oon.oon.ooo.ooo.ooo.ooo.ooo.ooo.ooo.sss.bbbh................uvvv............................................................................................................XXX.....................................................................................b....................................lll ........................................................................................+.................................iii&.....................................................................................I.......$............................KKK0........iii.........................................................................u.../...e.....]...-...J..K..U.........SRR6........}~~.........................................................................F...............Q....9.....5.........bccC..............................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):939
                                                                                                                                                                                                      Entropy (8bit):7.715337267518902
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:TgnmyMGQ6rbGPaBviHyDAdqrlGJvk60U5:T8AIbGPaligdUvz02
                                                                                                                                                                                                      MD5:2D40368B62CCAB60F49FA64586721507
                                                                                                                                                                                                      SHA1:209354B6EB8543E4E5006CC565518888E26A5F25
                                                                                                                                                                                                      SHA-256:106EE2D49EDCC53D777C46ED92E94D552424D5EDC1240A4D13CEBF7240BA004D
                                                                                                                                                                                                      SHA-512:F6331635FCF499B090DBF6F3D42C3476A35B6A8E0DF8ED55358C29DA4B938315E4CE2CAB3E2884D12B7B65FD9DC5EC05D4B35D887ACCCBC86ECC90305E7B3D1C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..S[k.e.~f......nvvc..mk+V.....Ik..(...(.^.......j..!x#.w....x(..sE...l.4.f7.=.y>..>...y..y..8...|.....5gu....f. BV....Q..S$..%....5.:0..7.o..es.....>o...j.OpMB.bb4.@.5........;..C.=.+...W.XE?#.P..UK......n\..@e..N`...a.....j?.$"<.0&3.R....g..{B*....H:...gI...B.%.2..#8..L...w[.8..Vmb!....'...GO^..`....PX<.k.=F.!.Z..9D9E..8...-s../.P.&>x......{E-:._4.d....a...LL9......=uf.......t.r0x.&[.-...*..D..$.dYF..0..&..4{$jA.H.4c......;.uG.....'.9...p]..j..O..Q..a...".)R...eY......F.s_.u9.`.6.8.O.3.c..a.7....p...R..#.X}"-.....B.@Z%...".p..\(........e...J.r....N#._..sP...)....K.sH8......`."..eL..........:g#f$.i""........Y..}....(.......~:..G..,O.8...y....N'.....h.X.I..aU...........#.,....P.Y...!.T.`.$...?o....^.......&T./P.I..v%.(.4.....R.-O.....,....ah..bW..n?.lnn.'=....QQ.KC.j..o.....W..r..P.{..A..v..`...6{_.{....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):322
                                                                                                                                                                                                      Entropy (8bit):4.990346257397384
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xJuWVLNxVnJwNbUQ5ne0oMKAX8VXzALysqcs57Jwyn:+WVLNxUbd5ZZK88FA7srt
                                                                                                                                                                                                      MD5:DADD037E0FCAF23F1FB8AF021329E6F8
                                                                                                                                                                                                      SHA1:FA4B3498B7FF91AA83036858902470B79ED44B3F
                                                                                                                                                                                                      SHA-256:BA919B0A6784A419D67BE03D57138900416A8F3896F744A8308026F846D8C634
                                                                                                                                                                                                      SHA-512:518B340222FFFF911053313C02A096D162EDA835B76945FA06837DF5C1EE86D783BF8DC83BDF32A521CFFC5AEFEF230A9EA67B33EC98412345F115748BDE5FEF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020010 ..version=1.0.0.1001..name=............[AppSetting]..icon=logo.png..smicon=logo.ico..title=..........url=http://static.apc.360.cn/cms/mini/education.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.08454985861445
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:Y96oqv8mYYZ2cbO752hMe5Drzv2nEKZZtP4hbBO+CG50Js0UOX2bEFalXy0rE2GE:AUeYZkwpXzvaJfPOYycs0EVlCBrECc4W
                                                                                                                                                                                                      MD5:1C48CB227F217912E6CCDB2B1D95B9DB
                                                                                                                                                                                                      SHA1:ABD047A0933CFD377F2F16AD2AF9577D53E8CEDA
                                                                                                                                                                                                      SHA-256:48048E284E74ED98B89470BDA05F48CF6618745348D64BE08D7789CF5FC4BEEC
                                                                                                                                                                                                      SHA-512:20209DE59D8233EB200D6D5F479389439185CC70542880BA57BFF289564CF00CB1C9243FCC9AF2F833B0AA2F60F7FD27C967DC72A39AA3E6697E80A1929E1C47
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..............................1a*1...7...7...6...6...8...4...6...8...7...6...9...6...7...7...7...6...7...7...7...7...7...7...7...7...7...6...:....CzZ.........@vIH...J...L...G...G...J...E...G...I...G...E...I...E...G...G...E...F...G...E...E...G...G...G...G...G...D...H...Q....Z...........L.QF...B...9...P...S...R...O...N...N...M...M...M...L...L...L...K...K...K...J...J...J...J...J...K...J...P...@...K....a...........S.`K...9....Yn..p...p!..n...n(..q"..r...t...p'..s...s...q...m...j...k...m...p...p...n"..n"..m'..n...n../.X.T...H...!f...........b.iL...9....PY..\...\...\...Z...^..._..._..._...^...d..%n..(p...j..#l...a...V...Q...R...W...[...Y...Y...W..K...K...%m...........[.wN...9....TW..b...a...d...g...`...^...]...]...^...a...^...f..6|0.].^.l.k._.a.N.R.1x ..g..._...Z...[...^..I...L...)v...........T..P...5....RN..c...^...h..X.Z.g.i.j.j.U.W.c.d.v.x.K.G..k...[...R...R...]...h..7z7.O.M.X.X.U.W.R.P.*s...Z..E...L....|...5h......`..S...4....SG..c...b...[...[...k..3}

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1741
                                                                                                                                                                                                      Entropy (8bit):7.282943200865706
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:QWHNn2qdIIhEhJ3d5eiPfmu+pYsjpHN8dCw:lt249+8int+pXpHNg
                                                                                                                                                                                                      MD5:A640F4C64FB4808A4DBF2692BC409C42
                                                                                                                                                                                                      SHA1:0B9CF0306C4839FED20F12BA509E265301CECD09
                                                                                                                                                                                                      SHA-256:1C0DFAFD20B039526B3DA6ADB2B3A4D6D79AB5A2E4CBB22ED9692053EA9C789D
                                                                                                                                                                                                      SHA-512:0CD3BF150CC5F45594AEB949218FFF0CBC06D44592FC60A12CB4DEA0C6ED904504E6DE9F8736F91B37029C63F0996AFBDD8E28C853AB3C65350967D9FBAD1D72
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:63D5451FFE5311E1AD2FFA46191422D8" xmpMM:DocumentID="xmp.did:63D54520FE5311E1AD2FFA46191422D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:63D5451DFE5311E1AD2FFA46191422D8" stRef:documentID="xmp.did:63D5451EFE5311E1AD2FFA46191422D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Ots...KIDATx.TS.o.E..fg...Y..7.7..4....P.....Th.p..pAH...w.\..8 ..{B.*.@.....Q.+$i......]..Y.X.ivF....}.^..e.xx...w..Z..Gw.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\back.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\config.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                                      Entropy (8bit):4.98799339009139
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xXsVVLjwVnDFJNNbUQ5ntIEE/MKAX8VXzALysqcs57Jwyn:psVVLkd7Pbd5tIEEMK88FA7srt
                                                                                                                                                                                                      MD5:CF905DAAE5C004070EBD349716ECC479
                                                                                                                                                                                                      SHA1:BC2A567CCE58FD7343441764B023B59D23883997
                                                                                                                                                                                                      SHA-256:74CCD3D8E720295A9BCAA7A8FF292F420629E61D718E7AA258CD5C4B854FF090
                                                                                                                                                                                                      SHA-512:89B9C36165C38230D17BE02D35E9CA208DB8E69835570C91C02913DB402C475034B65EFB0D1993C00429699B2CCE987ABD7BCAF883980146D39E7D928A41710C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020022 ..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/female.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\logo.ico (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 48x48, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):6.528254274979402
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:49hekd/ODFoHCkc+O/8bCyFoO47gojnHKC:4fexKHnO/5yFotkojqC
                                                                                                                                                                                                      MD5:D3BF36DAC2268F5C5EFC74FE319E1A2F
                                                                                                                                                                                                      SHA1:07F3E64272EC80535AD1E8B908396D94FF757C39
                                                                                                                                                                                                      SHA-256:C121021AE242D8128A95C4DDCFA6EA651C6479263D7A4C2E936285C6609D3C45
                                                                                                                                                                                                      SHA-512:7BD42380CA2BED8E9F0FF3E2AC7C6FE3F7981F9CF6C634D5FC5AD4F7263791F96698600D3BF53DE45B4E83B9C1A4522C61173D5DF686E8806F98707BAC60E544
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .....6...00.... ..%............ .h....6..(... ...@..... .......................................................................................X. .^.%.c)".\A".Zg&.`.(.c.,.h./.l.1.n.4.p.2.k.5.n.......................................L...Q...V0..YA..VQ..Wg..Y...]...]...\...^. .`.!.c.".e.$.f.'.g.).i.,.k...m.2.p.6.t.:.u.9.u.9.qL......................5%..N...Z...Y...Z...Y...[...]...^...a.".d.$.g.,.m.2.q.3.q.>!x.J-..K-..T6..fG..hF..oM...Z..{U...l..~\..J"..O).,..............#$..J..._..._...[.#.f.C,{.S:..^D..\A..mP..uT..qQ...^...\..{X...a...\..|T...V..{O..zG...G..x8..{;...p...n..._..xW.b..............2...]...`...[.3.o..j...a..}M..tC..s?..t=..n3..h2..g-..a&{.[&t.Y#s.R.l.R.l.Q.k.K.e.J.b.J.a.O.d..H...h...^.................#...@...c...^.&.g......R..K.j.I.h.J.h.Q.p.L.i.M.g.L.h.L.h.O.i.N.g.M.f.P.h.N.f.H.].P.e.['o.S#h.yH...c...a...x..................*...H.#.f..._.`F......p6..I.f.G.c.H.a.I.d.H._.K.b.O.g.R.i.S.h.P.e.O.d.N.b.Q.b.zG...h...o...l...k...c...`...q..................,...J.&.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\logo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1090
                                                                                                                                                                                                      Entropy (8bit):7.76613347959362
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:/REn/yTUsvAI2o+Zh2w28u6io330GZwL96cDUwhW+89:/+n/Y71+iw2Fo33JZ+Ecowhtu
                                                                                                                                                                                                      MD5:F441D279A97A40FB7DF8353BA76BBD7F
                                                                                                                                                                                                      SHA1:6EB2170AA2A9A989468B969FD78318A9713CD801
                                                                                                                                                                                                      SHA-256:52D4D1D796EB2D4DE9BDA84DE6055CB81B1DA303BC6FCF70D5CEABBAAB716DE0
                                                                                                                                                                                                      SHA-512:88BE0D88F553AECBBC9DCD6276F9063AD913F1237E733C35BC17F5A8C4BC34F4176AC4868E448455ED4D087E13FEB9A2BC92C7E460B86CA164BA3D6DC51807A5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O5S.L.w..M.....C...b.BQA..k.p..CD...t.R.RZ.>....8...XQ!.K.0..-.(...P.Mq...5s1..~.k.K......r9B.`........6.\.O.?..X..'........q[...b.}.Q.}.*../.....*......c..'..!0..g...=h.F........2jN....6..=.>.$tBw8.#sv.x..\.~....H..A....];.....(..~.L..7)..%.N/+...Z.-.r...(......nD~"..s1....eKP,.a.......U.be...9=.....f...x18...Q%.DlH*..Y...4......V...K(...TJX..|....k.......w..@..>.2.r../@.....r.+kqY.j.it...9....8.Yjz....=....{E.........B.j.q.S.N......s.A.g....\........F......... ....(..Ji%..l.:..B....)e.p..Nb."...T.P......$.<-.y. &8..P.....r..........A|H.j$..R{5..;lRe.}.~i5f.Mh..pJP.|.Q.y.Q.P.....[o.8O.............@...."s..m..0.7....>....MY.b@{.....d.p%....v..}.r.....\.q..._4.K.-8.~a.........QH...O..\+....#..`.j...'.'.....uA........RB.%...\..!.=.<Z8.>|t..a.G..4....n..6p.F|.p*....}.@..@.w........D(.<.=c........U0.i..s.0.G..!.........m].........~..E.u..A.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\InnerwebIDDict.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\MiniAppdata.xdb (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\MsgBox.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):510696
                                                                                                                                                                                                      Entropy (8bit):6.459926518380195
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:Kb+/Ln26GlBvxG4stUgGC9PkPCEFnKowWTa6Gh:n2HBor9PkPCEko7Ta1
                                                                                                                                                                                                      MD5:486C38F163027600AB117D4D1BA6F254
                                                                                                                                                                                                      SHA1:14997ABF08A3D2711209FC617D2AE91033AD8BDF
                                                                                                                                                                                                      SHA-256:0F7DDE159F497F194267B1400C05DD9304805B6B6AEE2A923F86C6854C38C65D
                                                                                                                                                                                                      SHA-512:65CD19982B9EAD7FEE58414B48D24F5BB99FDCA882E20A396153CA7BB10FA2F9FF15B6C97634EDB29E0AE5F926C5044382C8C45288E2520ADAF2F004C6DB5F2F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z.Q.z...z.Q.z...z.Q.z...z...z..z..Jz...z..\z)..z..[z...z..[z...z..Uz...z..Mz...z..Kz...z..Nz...zRich...z........PE..L....P.O...........!.....F...d......v/.......`......................................._....@............................m........... ..<>...................`..XU...f..............................h...@............`......<...@....................text....E.......F.................. ..`.rdata..MO...`...P...J..............@..@.data....j..........................@....rsrc...<>... ...@..................@..@.reloc..(....`......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\MusicIEFrame.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):584000
                                                                                                                                                                                                      Entropy (8bit):6.594932333601168
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:JGonh08rgTC/lBz7ZJJU6O0ksHXZwf5kbtwd3pMg0JeFR9Pz:JGcvroC1JJg0H3GYtwzT9L
                                                                                                                                                                                                      MD5:45DB84CAC7279600FFE76EA7DEF6839D
                                                                                                                                                                                                      SHA1:0FB498863ED8E0DCDD495D2171BB950CE6C614E2
                                                                                                                                                                                                      SHA-256:82E0C1FF9D3E88715D36B2E05E66360434C7D0AF0F8CB28E299E156544093B5C
                                                                                                                                                                                                      SHA-512:392ABF8B63E71DA621408A195CF21959D29521B8AF1F71521B06D4B89EF4A9562184F515FFA12C4AA46B8860DC9015C801042EBAC4204858FC2C64C433982052
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i@N.............p.......p........C.......U......./......p.......p.......Z.......p......Rich............PE..L...].[Q.................&...................@....@.......................... .......~....@..........................................`...w..............@.......t;...D..................................@............@..8............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data...$N....... ..................@....rsrc....w...`...x..................@..@.reloc...=.......>..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\NotifyDown.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\NotFound.html (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\Worning01.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\mhead.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfileTip.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\0.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4502
                                                                                                                                                                                                      Entropy (8bit):7.913847232220015
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwn/ea+W+62BxX07:/ShuweflgTMEEO0nKZ1R8ehBxk7
                                                                                                                                                                                                      MD5:03443B5ED06C4C0578E49FA140B1C6AE
                                                                                                                                                                                                      SHA1:0BCE94FA69102EA0CCDA90E42EFA4C070895426F
                                                                                                                                                                                                      SHA-256:A3AB9D0CC16B534EEE0ED9074CF0001EC13C47FAFB2ABE5A77C410DBF38ADC7A
                                                                                                                                                                                                      SHA-512:9E557DF066DD9B8285A141EEB483783C649E425A088495BC2DB9B2EB18AD1141F98F71EE049196FCBBA1428573938D9F020358D504A1C08EDD044DBBE614D867
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\1.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4720
                                                                                                                                                                                                      Entropy (8bit):7.910929199552645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwQ9IYDFUcX/Il1TXQNtWoH:/ShuweflgTMEEO0nKZ1Rf9IYD+I/O1Ta
                                                                                                                                                                                                      MD5:82C2A66ACA005AE47EFA6CE326ABFE76
                                                                                                                                                                                                      SHA1:1009671F3A2397528232F773590F251B1361567A
                                                                                                                                                                                                      SHA-256:A78939D1E1822D661C18905BF4FF002B069FEEB9E2B61443D6F8BED68F4BD3D3
                                                                                                                                                                                                      SHA-512:1E66793FEF142158EE9F767BBE66D3020A200113644D76A3E9F0BD0A07A19D0A645870F911B1A19086F7474043A1A04F17812CF76F4C7B5FD9EBF996E0967599
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\2.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4745
                                                                                                                                                                                                      Entropy (8bit):7.906551448003165
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwA9EHczkCM5yRyM0ADjr5:/ShuweflgTMEEO0nKZ1R56HfCDRyzA3N
                                                                                                                                                                                                      MD5:C948EB58717C808198DCB2253535C068
                                                                                                                                                                                                      SHA1:1E9FA3456ED43BC6F1688D38B44F28C5BB79F76E
                                                                                                                                                                                                      SHA-256:D78BD49006A2AAD356F7C043593256241A4FC2A7E63890002BA840BAA1027BBB
                                                                                                                                                                                                      SHA-512:E2748AA2D7EB462FB9B21E408A479B993A52B5DA8499BAAD6686F8DEF0FE7AB53B1D7AD686BA7174E85A2C08F64D1C52D4518443849209BB940C943F1796E506
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\3.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4784
                                                                                                                                                                                                      Entropy (8bit):7.91968879390982
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwnhfMROht+7hLUBvVqOmEw0K:/ShuweflgTMEEO0nKZ1RkhghgQw5K
                                                                                                                                                                                                      MD5:6FAD4397D817D28386B5888AF6E596F2
                                                                                                                                                                                                      SHA1:7922E4782457C1478D85B14D5DD44F3420A16076
                                                                                                                                                                                                      SHA-256:59394F229FD727EE54E4A93FC607249FB79C4E1CED49CD55C5F36D07D9F493F7
                                                                                                                                                                                                      SHA-512:70AC2D8BE829BB7B021211F83E71E3C1B546C8A9DA72A0F323ACFA6E8884D72AA64C097A2B95FBD7E0D133D0BC48E73F69D95B956C2DC616454083633FCB7994
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\4.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4833
                                                                                                                                                                                                      Entropy (8bit):7.915121783505522
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwY+6DKmz4RH7/QUBCx18Oi6O/t7Ie:/ShuweflgTMEEO0nKZ1Rf1uFH7/Q2C3e
                                                                                                                                                                                                      MD5:D9BA67EF6CFEAD7F1A62E579904241F9
                                                                                                                                                                                                      SHA1:98C13A03B56900C28E4DB7DB13A807D15F7B0AA6
                                                                                                                                                                                                      SHA-256:80199A066CB6E29A4131F034E92A22F687E097554FCD15D0497B6553BA04EB28
                                                                                                                                                                                                      SHA-512:434D4617638ACDD0A505A6F47613632FA7846F5857B554399393D716BE43F741A08C36E40219755A21A5764CB4348093BF6184B492A4445E5804C10DCB4CE2A5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\5.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4490
                                                                                                                                                                                                      Entropy (8bit):7.914756290833229
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwB+/ZRK0UhYQ12wau1:/ShuweflgTMEEO0nKZ1RI+T0x2wp1
                                                                                                                                                                                                      MD5:F8D45187D602D6B6BA49A4460695EA55
                                                                                                                                                                                                      SHA1:DFDB711F7E5AEEA31D41639E0477F4A7DFAFC0A1
                                                                                                                                                                                                      SHA-256:140347F6A1F50B6827359EF961F31CF7F7FB2B800FD730C21AAB437FB1EB4905
                                                                                                                                                                                                      SHA-512:E1382EAF8A4BBE93A48AAB86E3765133AD841CDB74D2C7B78B053DB9CECEDAF41E0425FE9695A1B1CBB386321B4BE919FB94603988D7658806ADFA7FC0B7121E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\6.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4628
                                                                                                                                                                                                      Entropy (8bit):7.9134281959066355
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw7DTfI/ya4WfUiW0B042od8:/ShuweflgTMEEO0nKZ1RIDSxfUiHB04k
                                                                                                                                                                                                      MD5:6EE23E80FDF87305D823AF28A755F479
                                                                                                                                                                                                      SHA1:F1F5AEB82A11407B46EF88171B0CE6E32BA33515
                                                                                                                                                                                                      SHA-256:B22B3DBE0B1EE0865A44343C598042E29B05A63E4647454ABE288F3612B1BF00
                                                                                                                                                                                                      SHA-512:FF2CCC273A063BF4D3F302FDC8384D63035EE8F071DCBEAD710CC94C173764B331ED26C356E5BF688B7761555CDB263405F2B88F6748D4A70CC380701A868C5A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\7.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4450
                                                                                                                                                                                                      Entropy (8bit):7.908145383039164
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwmWJ8muaMMYpnUF7WavfP:/ShuweflgTMEEO0nKZ1R2Jx/Mq7WEfP
                                                                                                                                                                                                      MD5:714DA01FA83B494EBFC4B0431A435578
                                                                                                                                                                                                      SHA1:A03B48EED86BEED3302D638967C2321532A4786E
                                                                                                                                                                                                      SHA-256:BC7A1749B485C7DD596E47AD2C333AFD4C618D4BCB6AC778AD22D2021CD5DE81
                                                                                                                                                                                                      SHA-512:1BE5417627205B56365963C6987E1AB0DC2E7EB8FAC2216491A4ED0FA77C354C7017CA80C0F75106EAAB9C27BC836DCF6BC72BCAD4DCE91D0D21835F348B3E48
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\8.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4500
                                                                                                                                                                                                      Entropy (8bit):7.917985621284803
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwWa8zQiPJUBoMdpWAc0m:/ShuweflgTMEEO0nKZ1RK3mUBoOBm
                                                                                                                                                                                                      MD5:A1D584A6F5E61C876A18AB41838167E3
                                                                                                                                                                                                      SHA1:32338EC7EE370EEAC323D7F4E08445B0E034F083
                                                                                                                                                                                                      SHA-256:2F818AD9FA9E8022846E67E1B7D3B63530FB7CD5AEAA82FF6331679D11EF40EA
                                                                                                                                                                                                      SHA-512:017B8CEC7199EABA9D2AA1D8442AEAFD134E4C461DCE436D71D92AA2017E7ACCFDDE325DF8F3876F65BBD64D86A910766886698415A0A04D1D6CCEE416270672
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\9.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4252
                                                                                                                                                                                                      Entropy (8bit):7.914745740309695
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw8ahU0JOI/nfAMB:/ShuweflgTMEEO0nKZ1RKU00IQM
                                                                                                                                                                                                      MD5:C49CA4AF0CD038C8E94AE523BAF96AA3
                                                                                                                                                                                                      SHA1:6A5DB9C4D78D1ADE228D589402669CA798F49055
                                                                                                                                                                                                      SHA-256:C6CD29C7CA458D53F98E05531EE0DB54162A07676A93EB7ABAD5DD612AE262D6
                                                                                                                                                                                                      SHA-512:04FD518735E92B4B495A0B3402477E31C25A414B96E32923280E1CC4B9A7758A19ABF3C9453D63F7E1976B9D4F9F9195E9ADD5D8CBB0239EE3F0B4791B2F93C8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\PswImg.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):150
                                                                                                                                                                                                      Entropy (8bit):4.496733935873367
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:QA/oeLl5VgC6fU/ubC6hNvJPhiM9TERQIC6IgBEoAovM4KgxeJvn:QoLl5kkubC+BHsQICfEEdHpoeh
                                                                                                                                                                                                      MD5:F381D25EDE8E75B43B15812D34639F31
                                                                                                                                                                                                      SHA1:4737138A26DFAC9A951EAA61284C474BF9E91D33
                                                                                                                                                                                                      SHA-256:2CD7942D3CC2E3B374AADFCF8845546680B4DBC7CD49D939C9B8FDF1E30F92A6
                                                                                                                                                                                                      SHA-512:402A706B8A885EACAD5F704028CC7CE38EA982F25FC03F557AFBCC0416CED2A1796501FC80BC337161DCFE4C692E19667010E820FDEA1D336F91D3D08E371E91
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[images]..count=10..img_0=apple..img_1=banana..img_2=orange..img_3=pear..img_4=tomato..img_5=beef..img_6=noodle..img_7=rice..img_8=fish..img_9=pizza..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\RegSMWebProxy.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):94360
                                                                                                                                                                                                      Entropy (8bit):6.439301229562193
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:EBw4ZQDGLJpVScRDdF26vamLBOgm0j4kLcq+UL1nINzs5FKSXssRwCaM:lVDGL4MRTLp91VQs5FKS8vM
                                                                                                                                                                                                      MD5:65CBBA195B71603A4FFB7F7F85CB100D
                                                                                                                                                                                                      SHA1:867AEF9332BEDB8A226EA43B711F7C39B77E55D3
                                                                                                                                                                                                      SHA-256:9A95725D30B843B195EAF7848B5A1F45F9542C3607F1F394EFC00840D1D2D61A
                                                                                                                                                                                                      SHA-512:7A539AAA037B05B960918B635D19AF4538468B280AFDEA747AED9E3E7A9EAD71C44DB2C594C9C91D2703F85969A86D3D654C5AC93A117E873C1C7BB093A253D3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..J?.u.?.u.?.u.6...,.u.6...S.u.6.....u.....4.u.?.t.L.u.6...5.u.!...>.u.6...>.u.Rich?.u.........................PE..L....q.O.....................t......QD............@.................................S.....@.....................................x....p...............T..................................................@............................................text............................... ..`.rdata...5.......6..................@..@.data...|=...0... ..................@....rsrc........p.......6..............@..@.reloc...............<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\SetupUtilDT.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):170344
                                                                                                                                                                                                      Entropy (8bit):6.515376474233682
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:X8cE5RULjRoG6LVI4P7+lLdoL6qY0foiStJv5LULIebzLo:Xb0RUfaGiI4P7+lLKmswRPtlG/o
                                                                                                                                                                                                      MD5:301A4BCA1A602AAD88C5E21AE2A8322A
                                                                                                                                                                                                      SHA1:73AEAF28C654C8AE61BABD5681160783520F5963
                                                                                                                                                                                                      SHA-256:977B181508CDE3EFFDE19A22B03127626AF6D96B6ED0B29B7AFB514B1646672E
                                                                                                                                                                                                      SHA-512:0A00B9274485FC4CA8EBA9BA90161AEC950034804076C79E4DE7DF76E971FFF179349E4BF6F72EF4F53D357E2D5D19584B7322C9C8D2DD1DE55BF2F1FBE22209
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eqz.!..L!..L!..L._.L ..L(h.L6..L(h.L...L(h.L...L..oL6..L!..L...L(h.L0..L?B.L ..L(h.L ..LRich!..L........PE..L...R;.Q............................=.............@.................................u`....@.................................LE..........................h...........................................H1..@...............<............................text............................... ..`.rdata...R.......T..................@..@.data....3...`.......D..............@....rsrc................Z..............@..@.reloc...$.......&...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\SwitchBar.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\TopBar.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UiFeature.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UiPluginManager.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UpdateTool.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):104904
                                                                                                                                                                                                      Entropy (8bit):6.415069485363196
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:IhlPjE30TlqLk62khxYOR8HIfsgjy8Lw1MACpfKT6FTS5iMVnwCaR:IhBjJlqLl49GpjHLwEfjFTS5i2nuR
                                                                                                                                                                                                      MD5:9882B5CB410EAD9CBF994D3473E042F9
                                                                                                                                                                                                      SHA1:C20212130A3A209104D8E7031ED8108E42D56C1E
                                                                                                                                                                                                      SHA-256:170B0F6255D1F3B4A8512353ABAA59D2B89D95D282F630782D7AD1721C849A66
                                                                                                                                                                                                      SHA-512:A0815915D407C46115719CD5D3B569E5F8D26FCC8BF46339C830E24242291BB961012A24221E08937D1AEA434BF4D17B13EA5E75693F657FE2B396AC5B165FD3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............g`\.g`\.g`\...\.g`\...\.g`\...\.g`\..\.g`\.ga\.g`\...\.g`\.5.\.g`\...\.g`\Rich.g`\................PE..L...}..P.....................|.......n....... ....@..................................S....@.................................xO..d...............................p....!...............................@..@............ ..t............................text...c........................... ..`.rdata...7... ...8..................@..@.data...`>...`..."...>..............@....rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UpgradeData.xdb (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\addapp.html (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):682
                                                                                                                                                                                                      Entropy (8bit):4.909863438974874
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:7WWZowjIzisjIXyjIirbHToONjoOiONsW6Yo6suXmMjIQ60TO7KwhoA+EoMOb:7WSj6isjRjTrbzoONjoFPlYoHDMjpFx5
                                                                                                                                                                                                      MD5:8BFE9D0B36CB07F1EFD8EF5447120ED5
                                                                                                                                                                                                      SHA1:304077E511928CC7F35D9B20E5C76F4FDDBFF64E
                                                                                                                                                                                                      SHA-256:BB8611D4C1CDD69DD0024768A782D4FAF9D40357EBF5415B4D92F7676EF8CABD
                                                                                                                                                                                                      SHA-512:501B6B3B7502F7FB47B7649580F313D20E4D0C1D1E38701E2CB16C0059C0C595820D95FD7C46DFE79F1C424E7614CCD3599BE9FE0478F96B3755A5E448897305
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<script>...function Addto360Desktop()...{....var title = window.external.menuArguments.document.title;........var url = window.external.menuArguments.document.URL;....var parent = window.external.menuArguments.window.parent;....while (parent != null)....{.....try.....{......var uu = parent.document.URL;......if (uu == url)......{.......break;......}........parent = parent.parent;......url = uu;.......}.....catch (err).....{......break;.....}....}......if (url == null)....{.....url = window.external.menuArguments.location;.......}......var obj = new ActiveXObject("DesktopMeunObject.DesktopMeunObject");....obj.Addto360Desktop(title, url);...}.....Addto360Desktop();..</script>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\bg.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe ImageReady], baseline, precision 8, 682x370, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):34299
                                                                                                                                                                                                      Entropy (8bit):7.886401642174046
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:49GOMIVwO5aeCKHpstGctFhM0IkE3ountxkOu3miS+PE2FA0ETeBm:4kIVNMoHpsgc7esS1noOuWi9E2K0Ef
                                                                                                                                                                                                      MD5:B550092E07391F8185F571A9FA468123
                                                                                                                                                                                                      SHA1:E46E480DBD44D633D9F3208D2082EF5996102B98
                                                                                                                                                                                                      SHA-256:BC079E3B3307D409A37B511DB9DDA0BC7C37847A4D1D370B33B7926068D2EE19
                                                                                                                                                                                                      SHA-512:375640C3656B7FCD1225DD5D15415642D1541B136A9190B83B32D8542B942BB0083AFDEB8A11AFD4DF81FEE09821990976866B17B2658DFCDE3B121D2C027536
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`.....XExif..MM.*.......1.........>Q...........Q...........Q...............Adobe ImageReady.....C....................................................................C.......................................................................r...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....p..-....R..P...as.......)..iw....)3.z...Aa@.T.J.b......Q.H.....R...{.......ri. w....o.._.c....@..U....2*;K...J.......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\errorpage.html (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\img\body.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2012:12:07 10:58:08], baseline, precision 8, 1300x900, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):38959
                                                                                                                                                                                                      Entropy (8bit):5.853823250628968
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:XjgIrjnsIrjn3U5TtE62Eop6tToxVWB0MPrEW2sfjPqxIbIrvBU:XjgIr7sIr73wtE62p6oFMDEW2szbcvK
                                                                                                                                                                                                      MD5:D09B2C3955C3CADBC31B1E4A6523C188
                                                                                                                                                                                                      SHA1:BF142841A6E5B45943D1C74431A349988D8858BC
                                                                                                                                                                                                      SHA-256:4F4C74A700CBAAB12B3664F3824E5B681F7929E4DAC2714F497D6C318A309D9B
                                                                                                                                                                                                      SHA-512:56C5474513B05F73AE514BAAC38EAF02A8ED94C406EF4E0A5B036E36080D210CF94C44076F35A235D71E77CBC9C11F900CFF71E31DA805CA2B4C5F435BB397DA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..II*...........................b...........j...(...........1.......r...2...........i....................'.......'..Adobe Photoshop CS2 Windows.2012:12:07 10:58:08.................................................................................&...(.......................................H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................o...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..RI%..$.IJI$.$.BxN..j......Q...&...C.1j6...+.....THF..$.&Ej.I$...I%?...RI%..$..&~I)p....h..........D..&.V.E".....HV....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\img\loading.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 420 x 18, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1909
                                                                                                                                                                                                      Entropy (8bit):7.234982063350527
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:PCCRgnxwhC+1SOLzA5+MTFC+M/BA6AlIxrYzI:KoyS8Og5rTA+BlCrYU
                                                                                                                                                                                                      MD5:9DA3F1D059FECE8DDB1F6EDF43AC2363
                                                                                                                                                                                                      SHA1:DB62DC742686C128F461938287DA27E4C522B1BF
                                                                                                                                                                                                      SHA-256:E923BC0678176F9847AAFF4AC59E9F7C39780469BA29F6BAA481BA99312EF7AC
                                                                                                                                                                                                      SHA-512:AA0DD1E1677D37386FD998676747D445D62DA8DF8A05B01A62FA5FE8D895EB428C473499C043957497AE7CAB63D6524A93B18ABDB900813355DD13D484BFC6F2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............#vZ.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEp.....t..............l..|..c..L..Z.....R..E..J..z..i..G..r..`....Q...S..Y..V..O..T..d.....M....ou.._..f..a.....G..{..{.....b........L..H..b..R..M..N..W..S..p..Z..l..t.......aZ..a..Q.....X..N..M....#M..s....mk..Y..i.....a..Y.......iZ..k.....r..R..V..s..s..o..Y..s..j.....s..z..S..c....t..X...H.......YS..F..^..I.....S..c..P..T..H..[.....w..R..P..L.....|..K..H..K..M..M..Z....hN.....l..]..R.....Z..R..S..S.....L..../Z..m..r..s..I....qL..N..a..Y....6R..r..Z....+{.....W..j....{O..l..^..`..|..g..M..j....JK.....W..v..t..d..O..J.......E...)i.h.._..L..p..J.....t..$j.`..b..f..L..^..e.v..6-p.[..a..:w.F.4a..,r.'n...26}.>.m$k......g~..]..6|.@.o..QR.3j..J....Zd..U.1%l.e..k....*2u.F..x..-s.M..G.%.....(...3.lc..'o......=..T..x..3t...t_.....|:F.....tRNS..................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\installflash.html (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\intalltempapp.html (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):519
                                                                                                                                                                                                      Entropy (8bit):5.160278137718593
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPgGxC7/mjWsVnqJmxTTqK5eQE8OYMCcfxqc2OAqUKCGb:hPrC1sV8IfvEYMCo9z
                                                                                                                                                                                                      MD5:B00593D03F76B157C02A72A9F132405A
                                                                                                                                                                                                      SHA1:FCE91F62543C4104BB906F3A83F6DEB7DEC0F5BB
                                                                                                                                                                                                      SHA-256:825D1318B7463FD5F670958C5E7BEC7D609340661EAD84ABB4F2E68FF987498B
                                                                                                                                                                                                      SHA-512:A33793891F05D7610FAD9D5B6F1EBCB4799871BE6F00C964E1390F36421085DC04DD1AE2C7BBB219FABBAB2FA94EAB2E923B491C81871A06EEA33EB639CBF2C7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..function changeProgress(value){...$(".in").css("width",value+"%");...$(".percent").html(value+"%");..}..</script>..</head>....<body>....<div class="box">...<div class="loading"><div class="in" style="width:0%;"></div></div>...<p class="percent">0%</p>..</div>....</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\style.css (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1657
                                                                                                                                                                                                      Entropy (8bit):5.247663084618733
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZICveGXqPF+9jJ1exEU+vZYNo+g8HVACmFnRlxnMXUbF:WJ1h+/RV++MZMrA9lxnMXaF
                                                                                                                                                                                                      MD5:7E0FB59D3AF2D442F44A939362311DD0
                                                                                                                                                                                                      SHA1:3F1FD2C2B9DDC773B6972F767BD321F353C6066F
                                                                                                                                                                                                      SHA-256:DF9459349CCB55416078BA535A17AE8587BF321049F4D0A5AF460879B62B4699
                                                                                                                                                                                                      SHA-512:03D0D5D69C38A7E1F75D39A31E9C597B862F9D1BEDFA14C4CB8FD37EFE5800FF01F97A917A8ABDE8C33E98A87436101D183250D101E5BB85B1686A1F3B3B7935
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...t-a-l{text-align:left;}...t-a-c{text-align:center;}...t-a-r{te

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\commonSoft.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\deskrule.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\desktoptool.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):815976
                                                                                                                                                                                                      Entropy (8bit):6.583545883404885
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:CHdnaQERSfWMwBsidpIitSeVkud0KWrQF8:QZXPudnWkF8
                                                                                                                                                                                                      MD5:5CFAE5D76DED38E1CB816B78D8E66D2C
                                                                                                                                                                                                      SHA1:924700D0891FCCA309EF6FBDA1877A82073FC68B
                                                                                                                                                                                                      SHA-256:B7F777BF003E3EEFFC846E483FAA6C435AD1266560BEAC4D51A95703AC12D701
                                                                                                                                                                                                      SHA-512:DDC75AEA59D9500E7BA8A4E592412752946935B518C90C3D2237422E12AF5790448918C6C938764EDAC39C98A65FD80C6DA7E8C2B4CD8047EB26B775F1476DFB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..eR..eR..eR.U*...eR......eR..7...eR.....eR.....FeR..?..eR..)..eR..eS.`dR.....eR..7...eR......eR.Rich.eR.........................PE..L....x.P.....................H......m>.......0....@.......................................@..................................l..,.... ...............`..h....@..ln...6..................................@............0...............................text...P........................... ..`.rdata...Z...0...\..................@..@.data............:...t..............@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtappcore.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):331440
                                                                                                                                                                                                      Entropy (8bit):6.5814193529642795
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:kzs3sd6FY2zMINPNwB7Ki21uEodEsi9x2lEcJAxcvyXAO8+/ylz:Ks3sdsY2PiBFxREsi9x27Wucy
                                                                                                                                                                                                      MD5:E2FB918E63CF2E8629227FD873A5A362
                                                                                                                                                                                                      SHA1:8CB0D496D8A7FE7359537B6B33FBE521A1DCA32A
                                                                                                                                                                                                      SHA-256:44C708835AE7F657AB5C07A465ED9375C810D907D1A17A5C33B31C2482515080
                                                                                                                                                                                                      SHA-512:CA91972D7ECD199F23304581D190F86AE9D0196BF7C7307C9F9E4AC84F9BD8D0C13D4BD4E5A1D3DB00F1837B468837789902620C974704B6C07866C23FE7A79D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........bk...8...8...8.8...8A..8...8...8...8...8`..8...8...8.8a8...8.8w8...8...8...8...8...8...8...8.8...8...8...8Rich...8........PE..L...qk.Q...........!.........X.......".......................................@......F.....@......................... ...y.......................................-...................................V..@............................................text............................... ..`.rdata..............................@..@.data...<>..........................@....rsrc...............................@..@.reloc...F.......H..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtfilm.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):799920
                                                                                                                                                                                                      Entropy (8bit):6.4627860261767065
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:4jM/yrSizUTnIzVWz7PWY9F9Y8yVrpfiFRJyNLcE:AliXJycE
                                                                                                                                                                                                      MD5:BE550CCD74044C170270D76FB2B38D2F
                                                                                                                                                                                                      SHA1:A87F969DD5F4744323CC3C7B49231E2117CABF7F
                                                                                                                                                                                                      SHA-256:1AAC90BF0D24CD4B164BCFFA338B4CFF3102C12769FD0A0777F2B964CFDDC8BA
                                                                                                                                                                                                      SHA-512:32C82C00F2097CBC42AB0308B7F35096C99014E9E93710B0FC027CEC0272B086AC745F31CF01490AA6117D4C6A2B215E01B67A942259CA49719A3097AB70854E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`..i.F.i.F.i.Fh&.F.i.F...F.i.F.;.F.i.F...F.i.F...Foi.F.cF.i.F.uF.i.F.i.F.h.F...F.i.F.;.F.i.F...F.i.FRich.i.F........PE..L....ZQ..................................... ....@.......................................@.............................................D......................(....'..............................h...@............ ...............................text............................... ..`.rdata....... ......................@..@.data............V..................@....rsrc....D.......F..................@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):146792
                                                                                                                                                                                                      Entropy (8bit):6.652917793404133
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:c8D6ap8rG5eDM8iTbcGiTKiSOufcReWTBf+r5wHvOc:c8ppeG5eP6itSaeWTB3POc
                                                                                                                                                                                                      MD5:A0778C2A0DCFF99F83CB63DB2537C0D6
                                                                                                                                                                                                      SHA1:253F2B000F046C62D77B48A87A4A99819D647996
                                                                                                                                                                                                      SHA-256:5C5BC028291B1940D03036F0D125EDB17BD2E6D3BE66900A16CD98B739507F2C
                                                                                                                                                                                                      SHA-512:84B058608B781B3383CCEB9A3FF26602E631CC398FD57C310EF785573F1FF6DA23070957D4554F6FA8526ABC6A6141432E154F186A4AF4D926C36BC5B414F8E6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S)V..H8..H8..H8......H8..0...H8..0..H8..0.. H8.0.U..H8.0.C..H8..H9..H8..0...H8..0...H8......H8..0...H8.Rich.H8.........PE..L......Q...........!.....d................................................................@..........................................@...............*..h....P..\.......................................@...............0............................text....b.......d.................. ..`.rdata...x.......z...h..............@..@.data....>..........................@....rsrc........@......................@..@.reloc...)...P...*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher64.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):167544
                                                                                                                                                                                                      Entropy (8bit):6.3438521480270085
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:QAI9+Gkf+xVpBHO9mNMy4ZFMV2bWqtsRi2TBf7sWr5qJcR2:zI9+GPJNMy4Pw2b+i2TBwWcW2
                                                                                                                                                                                                      MD5:F54B6E8B821138CE6110DE7B964E53D8
                                                                                                                                                                                                      SHA1:0EEFD010E4C9001B795B8A81FF2B8BDEB854A219
                                                                                                                                                                                                      SHA-256:DD983F896F412B264B9D0E2B296C63FFD750B81E1240794B312C967752D89DC0
                                                                                                                                                                                                      SHA-512:AC5BD4F315F3FDA20EAA0CAFC371491D936E1389C517B093CD561888FDBB96457A8F1848047F519419B86495BA890C394873CE998E6F5BCBDD746A533BA92C44
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jR.............3.......................................3i......3..........y...................................Rich............PE..d...h..Q.........." ................................................................(.....@..........................................P......x;.......................z..x.......|.......................................................p............................text.............................. ..`.rdata..............................@..@.data...PK...`.......:..............@....pdata...............V..............@..@.rsrc................n..............@..@.reloc..F............t..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtwebbrowser.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):760168
                                                                                                                                                                                                      Entropy (8bit):6.41146860850765
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:QZKD6SfHPAf/Xjd8xob+5kcc4cfpcJIU1GhDan4Jz/izR36nYNTYhrW6ZLsvMq:QZQkKxob1cG3U8hDa4JCR3YYNTYhy6m7
                                                                                                                                                                                                      MD5:26464985B396AE1DB6A2D6E7B070A3C8
                                                                                                                                                                                                      SHA1:D102D7817311F1999D0251A80DFEAC2895E8B0C1
                                                                                                                                                                                                      SHA-256:93AEF6CA6FA760D3783EE1157B3E9EAE1F6EE21C3D1BE39D4485DE6DA70F21E7
                                                                                                                                                                                                      SHA-512:FA2E8D7B352F05C696916FCF762A47BEFE119FD51148DC525F2AB569E98FC94E97EC1369E4ABDF07151069464DC9839E61C063C0336E6EA16A18F72F7EDDB5B7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1y..P.Z.P.Z.P.Z...Z.P.Z.(.Z.P.Z...Z.P.Z.(.Z.P.Z.(.Z.P.Z..zZ.P.Z..lZ.P.Z.P.Z.Q.Z.(.Z.P.Z...Z.P.Z.(.Z.P.ZRich.P.Z................PE..L......P.................L...6......it.......`....@.................................R8....@.............................................................h....P...w..@g..................................@............`...............................text...kJ.......L.................. ..`.rdata...{...`...|...P..............@..@.data............H..................@....rsrc...............................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtwebframe.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):171480
                                                                                                                                                                                                      Entropy (8bit):6.44138290249757
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:F4qo0pTzJR9UoHQfxhKQ2ulRCW/ZfGEAkz5GRWGgTo:uYT1X00Q2ulRCWBfVY3gTo
                                                                                                                                                                                                      MD5:755FE45383AAA53782A41CA691F700F1
                                                                                                                                                                                                      SHA1:405182FD8BD46541018002749DB2185364A2FD2C
                                                                                                                                                                                                      SHA-256:1BCA911A9D638D11634F4B1D27AED484163355ABA41E78312EE9DBDB7F062CA7
                                                                                                                                                                                                      SHA-512:BAE5191CF2544F8F107944483EA8298A5319E37779A162423A837F1B8E6C203CDD0692AFB9077A895C3BC16F1951C50263164A041EF3CAE69D95E00C978C3E91
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...up..up..up...?..tp..|...dp..|....p..|...Op..R...qp..R...dp..up...p..|...|p..|...tp..k"..tp..|...tp..Richup..........................PE..L.....[Q...........!................"...............................................R.....@.........................`4..~...\$.......................z...#......` ..`...............................0...@............................................text.............................. ..`.rdata...t.......v..................@..@.data...XA...@...$... ..............@....rsrc................D..............@..@.reloc.../.......0...J..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\feedback.ui (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):385200
                                                                                                                                                                                                      Entropy (8bit):7.182105590695188
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:MEvvCXZPBZirt5lLK8WqZaWZYlY2hE8XqYR/pURWepSmEU:M6CXdBZirtvxDZNYl44q+paWOSm
                                                                                                                                                                                                      MD5:28580334E670277D005E38D4C9E65CFD
                                                                                                                                                                                                      SHA1:7EBAF822980EE5DB3A7ADC20C5F266704433210C
                                                                                                                                                                                                      SHA-256:E4A42DD9B58F3D7B0A8493B837769C5D32DBF5EDE29A805E3808D4530E410E45
                                                                                                                                                                                                      SHA-512:1EF9C47842477F3F7553C5B9CAA30ACC2D1DCA73F3DF86F2E608DA9027B44AAE5B338DF389A7E050B2DF53CF8D20724596411392307F856D6E9CDA90F4F82AB8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................M.).......*......;.......<.@....9.......9...............6.......;.....+.............Rich....................PE..L...3..Q.................*.........._:.......@....@..................................p....@.................................@........................................D..................................@............@...............................text....(.......*.................. ..`.rdata...y...@...z..................@..@.data...............................@....rsrc...............................@..@.reloc..6l.......n...X..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GameBox.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1143104
                                                                                                                                                                                                      Entropy (8bit):6.908541805805633
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:M7rMZ9VnpbFmR3Wjih7gK3FNhAuqtqo40gu9xZu9xZoPyL7:8rm9VnphmQihVhAuYqo0u9Xu9XNL7
                                                                                                                                                                                                      MD5:8DD4CE4D5EEE031135A64117731F0187
                                                                                                                                                                                                      SHA1:139CB0851FDFEF952BC80307F22B9132B941F64E
                                                                                                                                                                                                      SHA-256:428A0546DCF68A9ACB6A2CDC6082168652E3D315493230D06C80102BD3D09B1E
                                                                                                                                                                                                      SHA-512:1930E581329EEC9B64AE1949AE84563E3F247C7AFF5622ADDB289D1630FB3364BF295CD1D610207D6B5BBB5FCEEC951614AEC9CA8DA4687333BA706D96D9E757
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..6...e...e...e...e...e...e...e...eM..e!X.e...e!X.e...e...e...e...eP..e...e...e...e...eRich...e................PE..L.....Q.....................t....................@.................................e.....@....................................,....P...............R..@....0..........................................@...............(............................text...:........................... ..`.rdata..P...........................@..@.data............<..................@....rsrc........P......................@..@.reloc..T....0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GbApp.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2015408
                                                                                                                                                                                                      Entropy (8bit):6.301459019627537
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:fxHf82WTNblrzv1I3pF4HYvMFkzFqv+IFPpds07XTuG+W40oS7B7L9xZY00:fxE9I3H4YCdpz7DuGvoGB7L9XN0
                                                                                                                                                                                                      MD5:F20C9B80E5D66E079E4350A1BA0F6295
                                                                                                                                                                                                      SHA1:1379EE0823F1B3284611B20F079CC7679C5B4FCE
                                                                                                                                                                                                      SHA-256:7764AABF7B2B1756980BEEB384A63106841188DC03A9EDDB79F8F2FE451B8757
                                                                                                                                                                                                      SHA-512:8B8608B1B318CF63D86AD4CD66BEACE9A0F294E9F986694B9DEB8C7A3338EFA05F8A0714A9EF6CCAE1384DE0452B29C603421AC00ECB1A489D6EEFC0FB6077B8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V.........w.S......P......A......F.u....~.......~.............A.......O.N.....Q......T....Rich...................PE..L...v2vQ.................t..........R.............@.......................... .......5....@.....................................|....`..Dn..........................................................H#..@...............t............................text....r.......t.................. ..`.rdata...............x..............@..@.data...d........Z..................@....rsrc...Dn...`...p..................@..@.reloc..hK.......L...Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\AppcenterDataGb.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):642920
                                                                                                                                                                                                      Entropy (8bit):6.282990832147541
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:5qBB65rJHvhc5gWES4bpbDBCWSul20XW6+MSP95HiVNT3yUO5VZPIxT2AdhWXhlG:7rYUbpnBCWSGP2AWXh5569l
                                                                                                                                                                                                      MD5:C9DCDAE63FC4BC3BED7298E7C6FB3D15
                                                                                                                                                                                                      SHA1:F573C038E3E005172F475FD4EE805060926BA3CD
                                                                                                                                                                                                      SHA-256:468A1EB791002CFC420EBF42DF8D9F07DD345B630584D30A74305EA0F0F62329
                                                                                                                                                                                                      SHA-512:2AC67254AFB1F12C8723FC031B95E73F8F07F15E2781CDFBDB03EB0C5D78CEEA47A52AD8864E3B7A488E96EC13B926F20265CB811F04F6F51A45E9E9A1E1A060
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S..S..S..t...R..M.n.V...|.R..Z...I..Z.i....Z.n....t...\..S.....Z.`.~..Z.x.R..M.~.R..Z.{.R..RichS..................PE..L.....%Q...........!.....H...p..............`............................... ......-.....@.........................`........t..x.......................h.......tT...b......................H...........@............`..l............................text....G.......H.................. ..`.rdata..."...`...$...L..............@..@.data...8U.......4...p..............@....tls....I...........................@....rsrc................B..............@..@.reloc..Ds.......t...H..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GBACCore_DefaultSkin.uiz (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GBDefaultSkin.uiz (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBox.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):156848
                                                                                                                                                                                                      Entropy (8bit):6.538614114866669
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:2c7Qonv+JBCrms558lMUVnUWxYAJ/Rtrpt2sytOSigKPiSj2eMsRw8e6ciPyyp5B:2G8Crms/8FnPBT7gxShAmwA5cgTx+
                                                                                                                                                                                                      MD5:46D0C5A9F1DFAFB0B842BCB2A944B1C5
                                                                                                                                                                                                      SHA1:233B8E2769625DD09A576035189D4CA3327E02A6
                                                                                                                                                                                                      SHA-256:BF84D8270CC9C4100D8DD52CFF5DEDD30CEDFF723BE38929FA32400BE5D97D8D
                                                                                                                                                                                                      SHA-512:E5026A954F575D4FB24109CAC306AC1D848EA62B16475CDC450D3CEFB4B93E1BC45559E99059F927FC2ADBCE7F95EA11BE2A45A7CCA2894C5AA6310F7355D855
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`.&...u...u...u.yVu...u.y@u,..u.yGu...u..u...u..u...u...up..u.yIu...u.yQu...u.SWu...u.yRu...uRich...u................PE..L.....RQ...........!................................................................x+....@.............................I............`...............J.......p..4...................................p...@...............,............................text............................... ..`.rdata..YF.......H..................@..@.data...H?... ......................@....rsrc........`......................@..@.reloc...&...p...(..."..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBoxCore.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1124528
                                                                                                                                                                                                      Entropy (8bit):6.484809189310972
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:Dp6e4S9JuvOCZLmvTO33iFnzQkOMnNf1bt:8S2OOGOMNf1bt
                                                                                                                                                                                                      MD5:5619853A5AC4F54323F54A949160EA52
                                                                                                                                                                                                      SHA1:60D787F954C12A23AB17DDED9F91C6C4B0B22173
                                                                                                                                                                                                      SHA-256:937EC6B0A8D5EFCA5E35F09A11BB6BDDA44FB4EFB9E0CBB9899BF67287820F3A
                                                                                                                                                                                                      SHA-512:1607C6A9614F5D5809BBDBA801E9BD2111977AEAE2114B35FA3110E662ED158AA107D6B2732579F7F34D26424D9C52B3800F0A045787F84363B13C8787B6A876
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j...j...j...8?..j..e%-..j.......j....8.ej....?..j......j.......j...j..Ok....1..j....)..j...8/..j....*..j..Rich.j..........................PE..L...$PUQ...........!.....l...........................................................Y....@.............................t...4........p............................................................. e..@............................................text....j.......l.................. ..`.rdata...+.......,...p..............@..@.data...\........v..................@....rsrc........p......................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\img_reader.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):203608
                                                                                                                                                                                                      Entropy (8bit):6.832543174324689
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:CxIYp86FpmNh/ZBypa4ZunTBfHFy6Ag0Fug795fz8:e86As2nTBvFy6AOIvo
                                                                                                                                                                                                      MD5:D3A9CA700C1C65D6DF7E010B0CB0E3F4
                                                                                                                                                                                                      SHA1:8E35CFC937B783808DA98376B5ED6163BD77148A
                                                                                                                                                                                                      SHA-256:CC4D278AB85A0CEF68EF29FDBF723830C4F2BCC78B5B315F1530674059BCF0CE
                                                                                                                                                                                                      SHA-512:8102BFEC316B89BF100350607491942332E881AA80981AEAEF8F607CAD5A4661B8E07BD9FE74506D8D775A56FACE181CF342074668338D42A3250A041AED4269
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...............u{...................uj.....um.0....u|......_z......u......Rich............PE..L....HdN...........!.................6....... ...............................P......x0..............................P...K.......<.... ..................X....0..........................................@............ ..,............................text............................... ..`.rdata....... ......................@..@.data....3..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\oauthlogin.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):343680
                                                                                                                                                                                                      Entropy (8bit):6.438296507662578
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:Od5qu1VG/cPM45zTHtcpBBzCXkLDLdfewus5qdr2ZdS1ltQp6:Odgu1VG/cPM4uBzCXkPLkwuwiu6
                                                                                                                                                                                                      MD5:A1ECB29EC8237F21ABD334830573EC34
                                                                                                                                                                                                      SHA1:DAD2D8F5976A018F3A5FE95C7DA5D8744971D5F8
                                                                                                                                                                                                      SHA-256:AB07B5413EB43D56151EA1B072945A3FC0C075BF108AE9977EDB46B7D102E9E9
                                                                                                                                                                                                      SHA-512:EABF128304CAB9540556984C43EFCA678897CA9DA07D5949C698156A6C38E8A23D037E98B7138D1930C33403185BDAACC842C79EFBA20FBEBB1379C437A2DEEB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tF..'F..'F..'O.3'W..'O.%'+..'aV.'A..'aV.'I..'F..'...'O."'|..'X.2'G..'O.7'G..'RichF..'................PE..L....NuP.....................t....................@..........................`.......>....@................................. m...........\...........(.......0...+...................................<..@...............|............................text...Q........................... ..`.rdata..J...........................@..@.data....E.......(...t..............@....rsrc....\.......^..................@..@.reloc..B,...0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\processinfo.dat (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\ACCore_DefaultSkin.uiz (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\BoxUI.uiz (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\DefaultSkin.uiz (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\ExtDefaultSkin.uiz (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\RSD.UIZ (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_Main_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\focus_rect.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_hover.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_press.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\tab_select.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\titlebarbkgnd.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_cloud_button.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_fence1_button.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_fence_button.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_shutdown_button.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_wallpaper_button.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\msgboxdefault.uiz (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_cm.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_disney.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\softdt.dat (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\softsignore.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\weather.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\config.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\defaultskin\MiniUI.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\defaultskin\Skin.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\defaultskin\defaultskin.ui (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\360Desktop.setup

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2818
                                                                                                                                                                                                      Entropy (8bit):3.8559297372687213
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+sO0rEMpNgwp2QaXlUrMlUC4PvNL2mrErXflzlfotMEyEd1GMZZBBCtGcsZBBCF:9KgwTaXjKWXfp9OMBTMZZCIcsZC4kZCw
                                                                                                                                                                                                      MD5:00F3065E2E29E877451434AA09D22208
                                                                                                                                                                                                      SHA1:8E2B2D93EF47F4B2B3E9F832981791A909C45C7F
                                                                                                                                                                                                      SHA-256:44CE1F2F7F9151376E3FC61E55C1307244ABA0124CF39FE184DECE73F2D7504A
                                                                                                                                                                                                      SHA-512:8C31B6262C3CF6F0D7A5288AEA358B0D7866F9E93BAD35AB2CF7AD0A0BB6AD908F03E6AB526A1268AD7803B9A75ADE3DB5D8DCED56920FEB5D3D4484F277EABA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.>..... . .<.M.a.i.n. .N.a.m.e.=.".3.6.0..[hQLhb.". .P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .E.x.e.c.u.t.a.b.l.e.=.".s.e.t.u.p...e.x.e.". .T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%..[.". .U.n.i.n.s.t.a.l.l.T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%.xS}.". .M.i.n.i.m.i.z.e.S.p.a.c.e.=.".2.0.0.". .R.e.b.o.o.t.F.l.a.g.N.a.m.e.=.".{.0.9.5.4.A.A.0.5.-.5.D.7.1.-.4.3.4.a.-.8.0.A.6.-.1.0.A.1.A.F.4.1.F.5.C.C.}.". .M.u.t.e.x.N.a.m.e.=.".3.6.0.D.t.I.n.s.t.a.l.l.e.r."./.>..... . .<.A.p.p.l.i.c.a.t.i.o.n. .M.a.i.n.A.p.p.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.". .V.e.r.s.i.o.n.B.a.s.e.F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e."./.>..... . .<.R.e.g.A.p.p.P.a.t.h. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.A.p.p. .P.a.t.h.s.\.3.6.0.D.e.s.k.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\Plugin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3902
                                                                                                                                                                                                      Entropy (8bit):3.5557288835319474
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+JVZlplUZlplfZlplEZlpljotElpl9ZlpljvZlpl9Zlplyn5ibEn5+vEnvlmpgS:dmfGp11p1FAfpE1otR3omfGpWA
                                                                                                                                                                                                      MD5:2DD2E9A30A526F127ED55D471E414368
                                                                                                                                                                                                      SHA1:80EE609ADD556B87E95BBF1C77ADFD0FE2DB05AD
                                                                                                                                                                                                      SHA-256:FF9B5847CBCDB3E9DF84505057E7CD36317308944526EDA5A042C3C81492CCE1
                                                                                                                                                                                                      SHA-512:CF85057B916932FE0CD7CB2FE0A183873C41868CD6EA72F13C7AB2058E37F29EA358ABC43B11D2BF9E086047970D43D2B974D8951D9D37BD24F10BEE041E0F1E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.P.l.u.g.i.n.>..... . .<.B.e.f.o.r.e.S.e.t.u.p.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".3.2.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t.6.4...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".6.4.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.M.W.e.b.P.r.o.x.y.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p.M.e.n.u...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>..... . .<./.B.e.f.o.r.e.S.e.t.u.p.>..... . .<.A.f.t.e.r.S.e.t.u.p.>..... . . . .<.I.t.e.m. .T.y.p.e.=.".S.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\Register.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2256
                                                                                                                                                                                                      Entropy (8bit):3.5953053564026893
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y++V47t7uJWg3oMDgVir4pMQaRkqcPsAwY:63qwvY
                                                                                                                                                                                                      MD5:35AA95AC9AC71D0FAD5E19C511FFFD2A
                                                                                                                                                                                                      SHA1:ADEEA5639F4C9558C44E73188CBD24C207FA7012
                                                                                                                                                                                                      SHA-256:7F9E467EF207FFB4F524C93AF58FE5E9718FF2F0BB2A7B8359FE44AAC1DE509D
                                                                                                                                                                                                      SHA-512:9ACCC1BDDDF6B4AA4DE212439D415A04A3BCA96F1F21B90A8CA9D65C88177DF91EE001DC940A57B61A5DAA9B70EAAD86BA76712780DCCE31376CB6580EE9DB98
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.e.g.i.s.t.e.r.>..... . .<.I.n.s.t.a.l.l.>..... . . . .<.!.-.-.>.......<.K.e.y.I.n.f.o. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.3.6.0.D.e.s.k.t.o.p.\.s.a.f.e.m.o.n.". .>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".E.x.e.c.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".S.i.t.e.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".I.E.P.r.o.t.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".3.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".M.o.n.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".U.D.i.s.k.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".D.r.v.F.W.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... .

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\UninstallRootDirFileList.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2330
                                                                                                                                                                                                      Entropy (8bit):3.4422158512260266
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+hUlzbb23QmSt2n16n1MHssRJlACXApDXeXyVBVaY636BhNvVPc:WUUu1i1NerACXAleXsBpb6
                                                                                                                                                                                                      MD5:55EA164B6BB418440F4659D7AFDE63EA
                                                                                                                                                                                                      SHA1:A54EF67DA77A369803FA4DBDFC3FE82A3864B622
                                                                                                                                                                                                      SHA-256:991B63FF2711AF2A635C9FC01FC296BC0A30B0ACA3CB0778E798349449F4CAF9
                                                                                                                                                                                                      SHA-512:68378479009533964F60AD7E3E515ABF573FB2E306231B9C3E867FC3B663A50DBE8A6DC7C0B1FB3453B7B69C9C52C50345F1719EE0CEF63C31BCC40E548FB1BB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t.D.i.r.F.i.l.e.s.>..... . .<.D.i.r.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".B.i.n.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".C.o.n.f.i.g.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".s.a.f.e.m.o.n.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".b.a.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".L.i.v.e.U.p.d.a.t.e.L.o.g.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".u.p.d.a.t.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".D.T.F.e.n.c.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".l.o.g.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".m.o.d.u.l.e.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.C.a.c.h.e.". ./.>..... . .<./.D.i.r.>..... . .<.F.i.l.e.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".7.z...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". ./.>..... . . . .<.I.t.e.m.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\filelist.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):82552
                                                                                                                                                                                                      Entropy (8bit):3.7230656395395596
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:15GYKRpRvAERQ3J3HzoE4oltGT8r2rchp+r+8D9NLx:15GtRpR7RQtrHa8r2jFD9NLx
                                                                                                                                                                                                      MD5:C9B3EF7097B1EB528A71EAD78B2CEEEB
                                                                                                                                                                                                      SHA1:803FC5D048BF9B6370BFCA85ABB0CC80B0701CA2
                                                                                                                                                                                                      SHA-256:8DBA5E7360352A2317F34F5C5CB7D712BD417F82D2B11C4C395695B5EAC049F1
                                                                                                                                                                                                      SHA-512:9038E006FB468AE4ECCDFBA131A1CB89200D225C5A8B4E4D764EFC279C01BF1ADCBBDB90A8F7065CBAA1BA561D03E892CC2B964E18A8B395BAF2182A4861B1AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.F.i.l.e.L.i.s.t.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".7...3...0...1.0.3.5.". .S.i.z.e.=.".2.7.1.9.6.8.". .M.D.5.=.".2.0.E.6.9.F.7.B.5.5.E.A.4.F.7.A.4.8.7.3.6.A.1.9.3.8.9.B.D.2.F.9."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".2...4...0...1.0.4.1.". .S.i.z.e.=.".4.7.8.0.5.6.". .M.D.5.=.".8.7.0.1.0.9.6.D.5.7.2.C.5.6.D.F.7.C.4.1.F.A.1.9.8.7.B.6.9.6.6.7."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.n.e.t...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...2...0...1.0.4.2.". .S.i.z.e.=.".2.7.5.2.8.8.". .M.D.5.=.".E.6.F.F.7.6.3.A.4.A.C.9.1.2.3.2.9.7.9.5.6.0.5.2.5.E.1.2.E.4.C.3."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.P.2.S.P...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...3...0...1.0.8.0.". .S.i.z.e.=.".7.2.4.6.0.0.". .M.D.5.=.".6.4.0.F.3.3.B.0.0.5.9.E.D.6.E.B.8.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\360Desktop.setup

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2818
                                                                                                                                                                                                      Entropy (8bit):3.8559297372687213
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+sO0rEMpNgwp2QaXlUrMlUC4PvNL2mrErXflzlfotMEyEd1GMZZBBCtGcsZBBCF:9KgwTaXjKWXfp9OMBTMZZCIcsZC4kZCw
                                                                                                                                                                                                      MD5:00F3065E2E29E877451434AA09D22208
                                                                                                                                                                                                      SHA1:8E2B2D93EF47F4B2B3E9F832981791A909C45C7F
                                                                                                                                                                                                      SHA-256:44CE1F2F7F9151376E3FC61E55C1307244ABA0124CF39FE184DECE73F2D7504A
                                                                                                                                                                                                      SHA-512:8C31B6262C3CF6F0D7A5288AEA358B0D7866F9E93BAD35AB2CF7AD0A0BB6AD908F03E6AB526A1268AD7803B9A75ADE3DB5D8DCED56920FEB5D3D4484F277EABA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.>..... . .<.M.a.i.n. .N.a.m.e.=.".3.6.0..[hQLhb.". .P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .E.x.e.c.u.t.a.b.l.e.=.".s.e.t.u.p...e.x.e.". .T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%..[.". .U.n.i.n.s.t.a.l.l.T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%.xS}.". .M.i.n.i.m.i.z.e.S.p.a.c.e.=.".2.0.0.". .R.e.b.o.o.t.F.l.a.g.N.a.m.e.=.".{.0.9.5.4.A.A.0.5.-.5.D.7.1.-.4.3.4.a.-.8.0.A.6.-.1.0.A.1.A.F.4.1.F.5.C.C.}.". .M.u.t.e.x.N.a.m.e.=.".3.6.0.D.t.I.n.s.t.a.l.l.e.r."./.>..... . .<.A.p.p.l.i.c.a.t.i.o.n. .M.a.i.n.A.p.p.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.". .V.e.r.s.i.o.n.B.a.s.e.F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e."./.>..... . .<.R.e.g.A.p.p.P.a.t.h. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.A.p.p. .P.a.t.h.s.\.3.6.0.D.e.s.k.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\Plugin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3902
                                                                                                                                                                                                      Entropy (8bit):3.5557288835319474
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+JVZlplUZlplfZlplEZlpljotElpl9ZlpljvZlpl9Zlplyn5ibEn5+vEnvlmpgS:dmfGp11p1FAfpE1otR3omfGpWA
                                                                                                                                                                                                      MD5:2DD2E9A30A526F127ED55D471E414368
                                                                                                                                                                                                      SHA1:80EE609ADD556B87E95BBF1C77ADFD0FE2DB05AD
                                                                                                                                                                                                      SHA-256:FF9B5847CBCDB3E9DF84505057E7CD36317308944526EDA5A042C3C81492CCE1
                                                                                                                                                                                                      SHA-512:CF85057B916932FE0CD7CB2FE0A183873C41868CD6EA72F13C7AB2058E37F29EA358ABC43B11D2BF9E086047970D43D2B974D8951D9D37BD24F10BEE041E0F1E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.P.l.u.g.i.n.>..... . .<.B.e.f.o.r.e.S.e.t.u.p.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".3.2.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t.6.4...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".6.4.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.M.W.e.b.P.r.o.x.y.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p.M.e.n.u...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>..... . .<./.B.e.f.o.r.e.S.e.t.u.p.>..... . .<.A.f.t.e.r.S.e.t.u.p.>..... . . . .<.I.t.e.m. .T.y.p.e.=.".S.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\Register.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2256
                                                                                                                                                                                                      Entropy (8bit):3.5953053564026893
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y++V47t7uJWg3oMDgVir4pMQaRkqcPsAwY:63qwvY
                                                                                                                                                                                                      MD5:35AA95AC9AC71D0FAD5E19C511FFFD2A
                                                                                                                                                                                                      SHA1:ADEEA5639F4C9558C44E73188CBD24C207FA7012
                                                                                                                                                                                                      SHA-256:7F9E467EF207FFB4F524C93AF58FE5E9718FF2F0BB2A7B8359FE44AAC1DE509D
                                                                                                                                                                                                      SHA-512:9ACCC1BDDDF6B4AA4DE212439D415A04A3BCA96F1F21B90A8CA9D65C88177DF91EE001DC940A57B61A5DAA9B70EAAD86BA76712780DCCE31376CB6580EE9DB98
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.e.g.i.s.t.e.r.>..... . .<.I.n.s.t.a.l.l.>..... . . . .<.!.-.-.>.......<.K.e.y.I.n.f.o. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.3.6.0.D.e.s.k.t.o.p.\.s.a.f.e.m.o.n.". .>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".E.x.e.c.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".S.i.t.e.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".I.E.P.r.o.t.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".3.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".M.o.n.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".U.D.i.s.k.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".D.r.v.F.W.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... .

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\UninstallRootDirFileList.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2330
                                                                                                                                                                                                      Entropy (8bit):3.4422158512260266
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+hUlzbb23QmSt2n16n1MHssRJlACXApDXeXyVBVaY636BhNvVPc:WUUu1i1NerACXAleXsBpb6
                                                                                                                                                                                                      MD5:55EA164B6BB418440F4659D7AFDE63EA
                                                                                                                                                                                                      SHA1:A54EF67DA77A369803FA4DBDFC3FE82A3864B622
                                                                                                                                                                                                      SHA-256:991B63FF2711AF2A635C9FC01FC296BC0A30B0ACA3CB0778E798349449F4CAF9
                                                                                                                                                                                                      SHA-512:68378479009533964F60AD7E3E515ABF573FB2E306231B9C3E867FC3B663A50DBE8A6DC7C0B1FB3453B7B69C9C52C50345F1719EE0CEF63C31BCC40E548FB1BB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t.D.i.r.F.i.l.e.s.>..... . .<.D.i.r.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".B.i.n.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".C.o.n.f.i.g.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".s.a.f.e.m.o.n.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".b.a.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".L.i.v.e.U.p.d.a.t.e.L.o.g.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".u.p.d.a.t.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".D.T.F.e.n.c.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".l.o.g.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".m.o.d.u.l.e.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.C.a.c.h.e.". ./.>..... . .<./.D.i.r.>..... . .<.F.i.l.e.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".7.z...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". ./.>..... . . . .<.I.t.e.m.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\filelist.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):82552
                                                                                                                                                                                                      Entropy (8bit):3.7230656395395596
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:15GYKRpRvAERQ3J3HzoE4oltGT8r2rchp+r+8D9NLx:15GtRpR7RQtrHa8r2jFD9NLx
                                                                                                                                                                                                      MD5:C9B3EF7097B1EB528A71EAD78B2CEEEB
                                                                                                                                                                                                      SHA1:803FC5D048BF9B6370BFCA85ABB0CC80B0701CA2
                                                                                                                                                                                                      SHA-256:8DBA5E7360352A2317F34F5C5CB7D712BD417F82D2B11C4C395695B5EAC049F1
                                                                                                                                                                                                      SHA-512:9038E006FB468AE4ECCDFBA131A1CB89200D225C5A8B4E4D764EFC279C01BF1ADCBBDB90A8F7065CBAA1BA561D03E892CC2B964E18A8B395BAF2182A4861B1AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.F.i.l.e.L.i.s.t.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".7...3...0...1.0.3.5.". .S.i.z.e.=.".2.7.1.9.6.8.". .M.D.5.=.".2.0.E.6.9.F.7.B.5.5.E.A.4.F.7.A.4.8.7.3.6.A.1.9.3.8.9.B.D.2.F.9."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".2...4...0...1.0.4.1.". .S.i.z.e.=.".4.7.8.0.5.6.". .M.D.5.=.".8.7.0.1.0.9.6.D.5.7.2.C.5.6.D.F.7.C.4.1.F.A.1.9.8.7.B.6.9.6.6.7."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.n.e.t...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...2...0...1.0.4.2.". .S.i.z.e.=.".2.7.5.2.8.8.". .M.D.5.=.".E.6.F.F.7.6.3.A.4.A.C.9.1.2.3.2.9.7.9.5.6.0.5.2.5.E.1.2.E.4.C.3."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.P.2.S.P...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...3...0...1.0.8.0.". .S.i.z.e.=.".7.2.4.6.0.0.". .M.D.5.=.".6.4.0.F.3.3.B.0.0.5.9.E.D.6.E.B.8.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\DumpReport.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):216704
                                                                                                                                                                                                      Entropy (8bit):6.532910128712557
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:l6VgjYzDal0nZySd3cZeC8PLErN1wuLydldZG649oL7xG4KKLylg5KMit8GC:kGczDu0kSdMeXLErN1wuLAlY9GdG/zbC
                                                                                                                                                                                                      MD5:E2CF8C3384795D23631D1A1B86E33FDF
                                                                                                                                                                                                      SHA1:FE160C83C7BB1EA2C8D4494C7BF91474B47CA5D8
                                                                                                                                                                                                      SHA-256:319227E2202B3B72CE20107A5FD05B90E89A69492D9F5DBACA3EDA95D2C86AD3
                                                                                                                                                                                                      SHA-512:AC579907580185D7809736AF2037623DFFED5F83B8FE0474238233EFE20F3001176D5007F0360F281E6D1DCC1EA74146681E642FBDF48228227ECD7998AFB822
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..q:..":..":.."...";.."3.."#.."3.."...".x.";..".x."-..":.."..".."1.."3.."w.."$..";.."3..";.."Rich:.."........................PE..L....q.P.................f........................@.........................................................................$........`...............8...............................................................................................text...ld.......f.................. ..`.rdata...~...........j..............@..@.data....P.......2..................@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\LiveUpd360.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):399344
                                                                                                                                                                                                      Entropy (8bit):6.525659947793564
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:Q60nOaN+UpBOp+j1stF+sb6YkgXti5Y2ch+:QJ06fIQ5Y2S+
                                                                                                                                                                                                      MD5:77106684F45C7C504B21AD948956734E
                                                                                                                                                                                                      SHA1:5043039A8BC35EE71D8F17B921F35D6DEBF01831
                                                                                                                                                                                                      SHA-256:F3803AB55BBFFFECA21BAB8BED43004A0DD019B1A97196602825E1D1D61C9554
                                                                                                                                                                                                      SHA-512:4DC02E47B6071395D7CDA332CE74109F92682C7A00346C3DC0160D9747881D78A93F38B20A7C4CEB1B5E25B1E6CC86D3AAC98780AE40F3378C4DE007CA951C9D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qW. 56.s56.s56.s...s46.s.y.s46.s<N.s)6.s<N.s.6.s...s"6.s56.s.6.s<N.sU6.s<N.s46.s+d.s46.s<N.s46.sRich56.s................PE..L....q.P...........!.........>.......+...............................................l................................../............@.......................P..|....................................U..@...............0............................text.............................. ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@.reloc..@D...P...F..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\LiveUpdate360.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):811656
                                                                                                                                                                                                      Entropy (8bit):6.876739267086473
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:FNi+QMNY5S0yQVkt/ozaCcTG8ky/D4CUpkJ8:FiboQWRozU/D4CUpkJ8
                                                                                                                                                                                                      MD5:41D9C718B95D971613AE0DD97487A3B0
                                                                                                                                                                                                      SHA1:1294F7361FD7CF3B40ADE74E72B1140C9C4CCD4D
                                                                                                                                                                                                      SHA-256:DA3AE4C54360E717F727F09152B5BBC91696501BBA4DEB727ECB868D1E66E818
                                                                                                                                                                                                      SHA-512:6E9ECDBE00F05CCCBB33013EFAD0661D0EB9FBCCEB1C4BFE24D619C06A34DEC9817BE2E53A925B34BB769700A4020247958C60C11B954E2A24CBD9BC4E635B7C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O..@.4..O...77..O...7!.SO.....O.....O...O...N...P...O...7&..O....6..O...73..O..Rich.O..................PE..L....r.P.....................J......UX............@..................................G..........................................@....................L..............0................................................................................text............................... ..`.rdata..............................@..@.data...Xt.......@..................@....rsrc................<..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\MiniUI.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1177688
                                                                                                                                                                                                      Entropy (8bit):6.566981597578591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:hmAickpYIlJwnR4F9BMt10HLXZSOzFeCfGCEXkWE2ayCMqM02yEhmAS1SD0YyqTY:n0YIlJwnR4F9BMt10HLXZSOzFeCfGCEM
                                                                                                                                                                                                      MD5:4A21ACD5FDB8E006E5CCFB259B557106
                                                                                                                                                                                                      SHA1:146CA6B76B8BF54E7C640D46AF353E9F84423972
                                                                                                                                                                                                      SHA-256:63360E5CD4806E6711E49878ACE346136AE829AB4EFA6C354753860E9A02BFE9
                                                                                                                                                                                                      SHA-512:A4C1023C138FD1E8CBB31E8BCDB65A16EE8D7518A6BE44B127A585DE66F19DD82B43FC4953FD68C276763EBBE6CE5152970A524257218A961A0C862F16BF7E45
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...ue.ue.ue..*t.ve.|.w.Te.R...we.R...fe.ue..d.k7f.}e.|.f..e.|.a.sd.|.p.te.k7v.te.|.s.te.Richue.........PE..L...g.vO...........!.........................@...............................0..........................................A..............................X.... ..\....F..............................`...@............@..h...l...@....................text....,.......................... ..`.rdata..1....@.......2..............@..@.data....w.......R..................@....rsrc...............B..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\PDown.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):210408
                                                                                                                                                                                                      Entropy (8bit):6.507157820903005
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:TJnuJFUvm00JlB8uLp/Me7AQo7ZWQueVMAI64kliFa/nyG5e0P9:9nuJFUvSJP/Bid9/VMg4klfiI9
                                                                                                                                                                                                      MD5:23944F2C8C2614814CD9EEEAD7C15622
                                                                                                                                                                                                      SHA1:FE5BFBED6900D976AC56EAC386423D82A35BDE7E
                                                                                                                                                                                                      SHA-256:68CB47636533713F460FA932975189BEFB0DDCA0750E8F75418B6C616F9BA3BA
                                                                                                                                                                                                      SHA-512:C16AC9EB39375950E554CB6C2814ECD385D39F2729DC2B26618647705D99DE7A2626759C3DEEB8C8A12E7658ECE6A5569FB1EF5D01B8F1CB8CFFAD7EEFE92555
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................o.~......}......k.A....K.........h.....l......z......|......y....Rich...........PE..L....q.P...........!.....L...........N.......`...............................`.......3............................................... .......................0..`....c..............................`...@............`...............................text....J.......L.................. ..`.rdata...y...`...z...P..............@..@.data...@<..........................@....rsrc........ ......................@..@.reloc..^*...0...,..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Uninstall.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1146032
                                                                                                                                                                                                      Entropy (8bit):7.1292448119285154
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:+jcxTzOiH74zs4urel9BlKfEZzss4Ueh4ffGs6bW2iYjS:+j1CKorel9icZzD4fh4fP6K8S
                                                                                                                                                                                                      MD5:B856763537C16C746EDCF36EFC187930
                                                                                                                                                                                                      SHA1:E384680D705C4098FF825B2B0F2ADD6FF7C40BA5
                                                                                                                                                                                                      SHA-256:585AFCC72620246453007DD33819E85F8B677DC2896C81BBB25F3A8BD05E4F68
                                                                                                                                                                                                      SHA-512:4F9A69E2689F4240C569DC3AB7CEB0C5EC094B3D355591F6EE30A3A6B15B7FF11DB2E7FB0038A5011F0615E68DE8D7FCBE2A193A88646EB2D129FD45DD37B133
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7I.OV'.OV'.OV'.....KV'.F...SV'.Q...JV'.F....V'.F...\V'.h.J.KV'.h.\.hV'.OV&..W'.F....V'.Q...NV'.F...NV'.RichOV'.........................PE..L...3w.Q..........................................@..................................-....@..................................>...........7...........b....... ..Dt.................................p...@............................................text...,........................... ..`.rdata..............................@..@.data....i...p...>...H..............@....rsrc....7.......8..................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\360Inst.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):894360
                                                                                                                                                                                                      Entropy (8bit):6.50736456481616
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:AflY25rYtl8e37Hgtry9Aaf31szCm5sktTWOW:ao5rAtuz31s++TnW
                                                                                                                                                                                                      MD5:7F485B9E043A2B95100E34D80F0AB72A
                                                                                                                                                                                                      SHA1:6B1AD0635BCA33E1A68ECC0F8945DF34A03B8F6F
                                                                                                                                                                                                      SHA-256:21A1ED802E6896AFC13692D4A66E48EF6C1C80C1EF91246703CC5529D3B21FD7
                                                                                                                                                                                                      SHA-512:5C900E97606D3177A24C3DECB4338544B4E1CB4D454DF3B91DC6CDD6BF2B68725A587B0237101674447B813D689942481F83918F5378AB21B76449DACA330717
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........WW".69q.69q.69q&)3q.69q.*5q.69qM*7q.69q.)3q.69q.)2q.69q.)=q.69q..3q.69q..2q.69qM>fq.69q.>dq.69qM>dq.69q4. q.69q.68q"79q.9dq.69q..2q.69q.0?q.69qRich.69q................PE..L......M..........................................@.................................m...............................................@..............@...X............................................................................................text............................... ..`.rdata..............................@..@.data....=..........................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):256872
                                                                                                                                                                                                      Entropy (8bit):6.339631168221611
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:3Xb99IZWz+PsND5nraXUrKronKAQLU/3PnXWvobxuaL5RVapOnTgVAO:HTVC0YUzKAQLE/nXR4pnAO
                                                                                                                                                                                                      MD5:DEC58427DAFCCF050DA9AC893E28407C
                                                                                                                                                                                                      SHA1:402F223A05C6CA83E961DCDA7FAEB7EDE7A37AF5
                                                                                                                                                                                                      SHA-256:F007E20E10ACC6BC15A5890961BC9D971D43BC004E685C6B32F7A2261C20A7EB
                                                                                                                                                                                                      SHA-512:DAB9B0CF62E65B48FFB018DD37867ED02650F0ADC1800110845030404C421BDBFC58FC2711C306963FC5FBDFFE29E4B99F38F277E8CC601FF9267848FD9A5951
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o.f.o.f.o.f.H=..n.f.f..x.f.f..S.f.f....f.H=..|.f.o.g...f.f..k.f.q..n.f.f...n.f.Richo.f.........PE..L......Q.................h...l.......#............@..........................@............@..........................................@..`...............h........... ...................................@............................................text...1g.......h.................. ..`.rdata...b.......d...l..............@..@.data...|@..........................@....rsrc...`....@......................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1746672
                                                                                                                                                                                                      Entropy (8bit):7.994118615758001
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:49152:qQQgSWLXONX2QQIxDZcn/tAFKtJcMEhnmAr5ZS2VfP:qcverZ4BXcBm83S2VX
                                                                                                                                                                                                      MD5:02C91D3BE856789E1711C37649F382CC
                                                                                                                                                                                                      SHA1:6FE184CE5D2198CBB6CCFF37BCDE5F9950BF9ECE
                                                                                                                                                                                                      SHA-256:26286D2C63A0DF39CDDEB780B626D807C92A0B071D9C313010F24692BD98E2A1
                                                                                                                                                                                                      SHA-512:A2279790AC31A0DC625CE0390EA2F33C8AD1ED125F2862A46117EF94830FAB66A92D76B8F49F6B8284DB9F306E2F9B4835A728BE381FF6FE126D52228D02AA0E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................P......&/.......................................s...........G..........@................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....G.......H...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1412584
                                                                                                                                                                                                      Entropy (8bit):7.990098245004688
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:24576:XbduHjw+g0xZXPga+rRrh0C1hgptkWgq9UHluMqs5/JsB23egfPti:XbdGw+guZ7+xhrhEFgquHz/k2Ogf
                                                                                                                                                                                                      MD5:32DC2FA6DB8B8809B12A8CAD215C69FD
                                                                                                                                                                                                      SHA1:0C6232CDEE1976179AF0C0CD9CF7E7A07D1F4C42
                                                                                                                                                                                                      SHA-256:1FE187BEE814736553B90DED2581060F2AC5A81950876CD9418CF352DD236FE9
                                                                                                                                                                                                      SHA-512:10B9467BEB0D71C41BBD487CAA6714CBFE519CA767792E029D39CECEBD660CE16E4DB6833BFD8370EC5628CF83BEB6E5E31C5966997D192895C7485A335C9C4A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................0...............................................s...........E..........8s...............................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....E.......F...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\SwitchBarCloud.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):494
                                                                                                                                                                                                      Entropy (8bit):5.057595445515239
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/WgsZLr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/K/Xe/JEm
                                                                                                                                                                                                      MD5:5A3EE026FF55F8DD65A26FBC186FD5DB
                                                                                                                                                                                                      SHA1:EEF2D54C1A38091E8D61F9BF5B9F4715946D6EC2
                                                                                                                                                                                                      SHA-256:86EC857FD7844036CABE640AB49F92784C9225463413FFE1B406F2FB80772372
                                                                                                                                                                                                      SHA-512:376E27A5D2DCC391A5C85A51518BBFE2559B72107AB05D0068E04928247688887D56FBED60A19429001B4FC870FF5C6F8914464277E1EA6AFAD63DC3F83F3359
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1003" Enable="1" Visible="1" Image="topbar_cloud_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\360Preview.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\360Preview.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\360desktop.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\ACS.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\TopBar.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\deskrule.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\feedback.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\processinfo.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\softdt.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\softsignore.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Bin\weather.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Config\config.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{63FE85C4-CA17-4452-A765-F1ADA7626A18}.tmp\wftest.tf

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Common.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):271968
                                                                                                                                                                                                      Entropy (8bit):2.7198331920728727
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:xVepfNLvvRB47p+UMXDcOKXYumQN+o5kJAIcPXXvHsnRAvwwCaq:xVahBoMzcOnZ3e0AIcf0nRA9q
                                                                                                                                                                                                      MD5:20E69F7B55EA4F7A48736A19389BD2F9
                                                                                                                                                                                                      SHA1:B104DD43F009AF3AB490C79CA3FCD5BDB7585965
                                                                                                                                                                                                      SHA-256:6C608C5C17969CBFBD43051E860BBA4B9AEDDEDFE57A7310DA37024BA688CBBD
                                                                                                                                                                                                      SHA-512:36627BD215C2AFFD4DEC5E3FFAD5CFB7B44AE7FB2FBA4C582867AB248F88FFD50D1537CA86810CA107CF2A672E8016BF34B71C35EBD396C6A2C48AE66FFDABE1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N...............q.......T.......<.......e.......e..............<.......e...................................<.......................Rich............PE..L...9..N...........!.........0......'........................................0..........................................=...H...........................`...............................................................t............................text...b........................... ..`.rdata........... ..................@..@.data....;... ... ... ..............@...history......`.......@..............@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360P2SP.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):724600
                                                                                                                                                                                                      Entropy (8bit):6.515371619339392
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:xnFslNsHuR4pg6uEBj/jRK5nYg2DNfMC+zFXTX94/wo9Tm5KO1f:5FslNsO6yft2JfMjzFXTt4V9To1f
                                                                                                                                                                                                      MD5:640F33B0059ED6EB89AA5133263846D3
                                                                                                                                                                                                      SHA1:F1BC1491BBF6DAEC1FB2B1AA3437BBA4C3D3D0BA
                                                                                                                                                                                                      SHA-256:677C9F6A9DF66F0F086931AD46B28B4C94BFF7A28960B8E9970B84801D633AD8
                                                                                                                                                                                                      SHA-512:14E3A419C0A75B3780903889A0D4921AB7487ECF53272C10042DB4D211D15C226A10CF8C25AA23E143EBFE77C15A7A9D6FAE3BD2F4EAA5A701295A8AA6405313
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^i..^i..^i..y..._i..v..Vi..@;..[i...&..[i..W...~i..y...Ci..^i..i..W....i..W...*i..W..._i..@;.._i..W..._i..Rich^i..........PE..L......P...........!.....v..........<Y..............................................-.....@.........................pX.......D..,....0..................x....@...S..`................................................................................text...,t.......v.................. ..`.rdata..B............z..............@..@.data...@....`...:...F..............@....rsrc........0......................@..@.reloc...q...@...r..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Preview.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Preview.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360Ver.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):49328
                                                                                                                                                                                                      Entropy (8bit):6.422529932487228
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:iCG1hD297LhgEl6n17lNOJG012doMRSX+aeun:7GU7Ngf17nAQRSX+ae
                                                                                                                                                                                                      MD5:906222E77961059370D5DAFCAFE6C012
                                                                                                                                                                                                      SHA1:69778D3AB991E5BF48C70DFF197ABE31AB45722E
                                                                                                                                                                                                      SHA-256:5645C19FE54ED2C736324B89C16E2DE5236EF8162796DD248EF3C89848BE1C4F
                                                                                                                                                                                                      SHA-512:DEE872E6A3E70319DBF0D66C67E0645A82176B83C1FB36D3B03F133E2F57A73662031E48F8F882B59ACBD072B7B4702D11122197C2D8C2B2813372D8B108843C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............s...s...s.......s.....s.....s..z....s...r..s.......s.....s.....s.....s.Rich..s.........PE..L...x8.Q...........!.....d...>......R................................................"....@.............................K.......(................................... ...................................@............................................text...Tc.......d.................. ..`.rdata..[............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360dtpreview.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):478056
                                                                                                                                                                                                      Entropy (8bit):6.69121493887301
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:JXTGWxHK5ZdldE/BvlqcmLaMlQnycplieut:LQ5ZdlQqpLaMWyRtt
                                                                                                                                                                                                      MD5:8701096D572C56DF7C41FA1987B69667
                                                                                                                                                                                                      SHA1:4675615065FE84A53B83FDD87444118592833C22
                                                                                                                                                                                                      SHA-256:CEE0805961B49B50E15D51E5EE5709B74F63D91B33B24147A6A328E81CA806CE
                                                                                                                                                                                                      SHA-512:B104A0BFD1156450FCD3AC21221D42571045E3C2C52D66E87B33332320627E11F443E1640E1F488A1EE59BC83B0E332E7C998932B56712D45021D0C20F048E39
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.)LS.zLS.zLS.z...zMS.zR..zIS.zE+.zUS.zE+.z.S.zk..zFS.zk..zWS.zLS.zsQ.zE+.z.S.zR..zMS.zE+.zMS.zRichLS.z........................PE..L...k~4Q.....................|....................@.................................rI......................................h........`...5...........8..h............................................P..@............... ............................text............................... ..`.rdata..............................@..@.data....s.......6..................@....rsrc....5...`...6..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360net.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):275288
                                                                                                                                                                                                      Entropy (8bit):6.682710718683491
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:Xxn20OeU6F/uixt2soJiM3EbmaOCs8WgNeDuctl4dzNQvB2YEGw069uK309tM0Xi:XJRUih2sevZsNeaVzSvBbX6019taPE
                                                                                                                                                                                                      MD5:E6FF763A4AC91232979560525E12E4C3
                                                                                                                                                                                                      SHA1:366D43F4C049137114FE0D72F84547632A399DD4
                                                                                                                                                                                                      SHA-256:250BBC73FECDA4023E52D0D07FB3B77889D4D20BBEA55C59304237F0A1D5F763
                                                                                                                                                                                                      SHA-512:2DBD3ACEC39CF7559DD22DF8F2EB2B1B5AE31D65599E3327F7910F375F10A49B7E6AC0A714A1C8D492D33CEFCC8955D5BE6D3AF7BE71B3BA94E54B5AA1437EC9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<.....w.<...G...<...=.y.<......<.......<.......<.......<.Rich..<.........................PE..L...{..O...........!.....f..........;...............................................................................0...z...|........@..h...............X....P..H .................................H...@............................................text....d.......f.................. ..`.rdata...s.......t...j..............@..@.data....6..........................@....rsrc...h....@......................@..@.reloc... ...P..."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\360verify.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Apns.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):246632
                                                                                                                                                                                                      Entropy (8bit):6.5486755725416606
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:lUxMO3N5k6yS0ebgKEImqGGtzaIp3Pw8UjpkT7KoXICt7+3ex5rEQwpg:mlk6/0Ajfwt9kfZt79Mg
                                                                                                                                                                                                      MD5:6BF5C438B4F13F257E075B4A5B82721C
                                                                                                                                                                                                      SHA1:C9827FF84E04C62E326965330193D81115A7B710
                                                                                                                                                                                                      SHA-256:D251A672A8DCF9B03896CA462AB40A8AF62E0CB1CCF9333102311BDE8C28333B
                                                                                                                                                                                                      SHA-512:7BFA4E47134DB9CA95F6AC6142B9602F216696975925B0BA3E461C35AFFACA20A2CB48F6EA1D85193965226415F4EB3900EBB8D6DA2688FB49920118A563C87F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xy.:<..i<..i<..i..i=..i5`li+..i5`}i...i5`zi@..i..i3..i<..iC..i5`si7..i5`ki=..i"Jmi=..i5`hi=..iRich<..i................PE..L...(*.P...........!................6.....................................................@..........................f..p....\..x.......h...............h........ ..................................."..@............................................text...1........................... ..`.rdata...w.......x..................@..@.data....B...p.......\..............@....rsrc...h............x..............@..@.reloc..D........0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360AppCenter.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1182720
                                                                                                                                                                                                      Entropy (8bit):5.878790145137298
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:vQythN900YbDlxdml8TBcLZC58+bm/568r:v+0Wl0LZW8+q/s8r
                                                                                                                                                                                                      MD5:DFF6CB443FE4D03F1C1FA454E6BA6777
                                                                                                                                                                                                      SHA1:7C133A85C43F2FD4B318B7B3DBF0DAA4E0B784B8
                                                                                                                                                                                                      SHA-256:51590C1C13A3356F664BCCFE6F87EC80DC8CC275F2984CBA693D9B01F2DE0057
                                                                                                                                                                                                      SHA-512:E2B9267E5A26D0E9B886DBC4B4712899FA9166D3BF1A03359574DC7081A4B4877F65540232E59487ACDF07AEAFC943842E1B573A0684B1CB5F48DFACB4ACE926
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%..D.D.D.2.u..D.<v..D..g..D.<`.!D.<g..D.....D.....D.D..E.<i..D..w..D.<r..D.Rich.D.........................PE..L...^|.P.....................J......M.............@.......................................@.................................|............J.......................\..................................(U..@............................................text.............................. ..`.rdata...4.......6..................@..@.data...<........2..................@....rsrc....J.......L..................@..@.reloc..B............^..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360AppCore.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):158568
                                                                                                                                                                                                      Entropy (8bit):6.396896358849047
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:LpgByzIin2++g7LXW9rLhQMuUKavLW1rA239Flao567MWse:LsLFCy9RQMuUKavL78Fqrse
                                                                                                                                                                                                      MD5:7A0E3BE308D1900CE4CD241A8948FD67
                                                                                                                                                                                                      SHA1:BA925C92F200D39666F91F018CD10D75DA1BFD74
                                                                                                                                                                                                      SHA-256:2305E91C09A60FD90C3963C8F95CA7032CC5696D4A122DD5C4798C9BC9343B39
                                                                                                                                                                                                      SHA-512:6D4FE7370C41FBBFAFF491207A342D19BBB5DA35F2DC4AACC683B1E6EF2098B4B2DC965E958B92D9154417CD1DED6699B6616F2B557FFAEB5277D347BA435CF9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.uA\.uA\.uAU..AO.uAU..A..uAU..Ae.uA{a.A].uA{a.AK.uA\.tA.uAU..AM.uAB..A].uAU..A].uARich\.uA................PE..L......Q............................z.............@.......................................@..........................................................X..h...........`...............................p...@............................................text............................... ..`.rdata..Da.......b..................@..@.data....R... ...&..................@....rsrc................(..............@..@.reloc..0).......*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTFence.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1088688
                                                                                                                                                                                                      Entropy (8bit):6.560009016874765
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:3hQovqIB6QAnhTDxyGkA0FBVYOfT9dHtnTUr8U11zXJ:anh5nOB1fTnNnTUr8U11zXJ
                                                                                                                                                                                                      MD5:84070772563D6FF84A462E0ECC089A6A
                                                                                                                                                                                                      SHA1:AEFD66A7416B72B4CEAFFB3F734C0CB0DA96E24D
                                                                                                                                                                                                      SHA-256:0780014E5076B5AF7B00C5F54B2AF20D451A85CFFFD9C647EB1F24092FEC7453
                                                                                                                                                                                                      SHA-512:4C90843363E6A7C6687D03C95EC83BC97D2B6A3F2A13D6DBA0CC8266BAAE82E11DB031D89423A9C32C70B6C5361893BD4B98A754F7CC037C4CA7B453E8A1D7A0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Cr.>...m...m...m.\`m...m.kcm...m .m...m.Arm...m.kum...m.krm[..m .m...m .m...m...mX..m.k|mj..m.kdm...m.Abm...m.kgm...mRich...m................PE..L...DB.Q...........!.....................................................................@.........................P...............P................................................................@............................................text...[........................... ..`.rdata..i...........................@..@.data............:..................@....rsrc.......P......................@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTNotify.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):558536
                                                                                                                                                                                                      Entropy (8bit):6.585730875870462
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:2EspBEHRraG0om05h7vV4nkXxWy0gPAb+pCL4q9plyTlFeM6LSfUSm:XKE0TJkicAbiCLxpt6m
                                                                                                                                                                                                      MD5:FAF9DFFB6136E079875A3484C28F9719
                                                                                                                                                                                                      SHA1:6DEC0F4096B36D2BC47E5C34599EC02407C39A03
                                                                                                                                                                                                      SHA-256:437396474FF3AB9B1A6C79ABC8174A8641A9F38400EB1FAE068F2B233533275E
                                                                                                                                                                                                      SHA-512:88BA62DDDE2774DF77EF0A4BBB60A2C873AA78EE5EB2B385EFB2289778FAF4B7F98E4E9B9106B06E3074D0EB453F1879835612AD2B6002179BE6C92FDB437D94
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..i-..i-..i-...-..i-...-..i-...-..i-...-..i-...-.i-.c.-..i-.c.-..i-..h-.i-...-..i-...-..i-...-..i-Rich..i-........................PE..L...i..P.................J... ...............`....@.................................G.....@..................................[..........`M...........n.......@...V...e..................................@............`...............................text...@I.......J.................. ..`.rdata..*....`.......N..............@..@.data...<e.......D...d..............@....rsrc...`M.......N..................@..@.reloc...w...@...x..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DTSwitchBar.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):337728
                                                                                                                                                                                                      Entropy (8bit):6.542349002922983
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:JGOalWTNOn7XCrlxG2XjuwQBiK51uOVowDfwl+s8EkZpGW1eI8N:gvlWBk7XsxG2XjFYiK2rwDfpsdkZgQ8N
                                                                                                                                                                                                      MD5:0C6BD516E25819B3970AC08BFC4E714C
                                                                                                                                                                                                      SHA1:91326186199377DAD7A7D8673F4B221CFD78DC95
                                                                                                                                                                                                      SHA-256:DF2638D240CF56D5AF9130B921D20903837E3DF941B183695D2F9AC59A956A72
                                                                                                                                                                                                      SHA-512:95C9E45CEEC10EEF848C81EBB628EC99583F359E0E95AF6BBEC8F9ECB951A350BBA6CD951432995A41025F70FE7C86F90BCE2A0108E19C6ED38DBD5079197031
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.fFn...n...n...g..x...g......g..Q...Ihe.m...Ihs.q...n...'...g..N...g..o...p...o...g..o...Richn...................PE..L......Q...........!.........2..............................................P............@.........................0...L...T...@.......`...............@.......t3..................................h<..@............................................text...c........................... ..`.rdata..|...........................@..@.data....K.......*..................@....rsrc...`...........................@..@.reloc...I.......J..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Desktop.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3760960
                                                                                                                                                                                                      Entropy (8bit):6.516553406742661
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:rEEfHBcxvOZtQDR68oBPAaVNhr4OCQsfQr5OEeJPHfXhH3ihdzaHt:t+28w9VNhjoQryJPHfXhXl
                                                                                                                                                                                                      MD5:2A73AC6CA39608C3B4E0D857749C4EC9
                                                                                                                                                                                                      SHA1:E344442CAA863EF3235DEAA69DA7D0C64E7AA04A
                                                                                                                                                                                                      SHA-256:3E42972666B237C4FC16A412E1ACCD7D756AF95E5C05D71CDD07BC6ECBAB6FBB
                                                                                                                                                                                                      SHA-512:F5052D7FA191C34BE38AE4DE7E246BAF599504D8BA46DAFBF5D70E01C954011F353AF1BE59199B495C27CB370D390F94BFA85E20012F45678FF361F6169C53CB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................E.0.......3.....@........".......".......%.$....@.......@.........s.....,._.....2.......7.....Rich....................PE..L.....Q.................D+...........&......`+...@..........................p:......a:...@...................................2...... 5.@............D9.@....@7.Dn...y+.....................0./......./.@............`+.H............................text...JB+......D+................. ..`.rdata.......`+......H+.............@..@.data...h.....3.......2.............@....tls....).....5.......3.............@....rsrc...@.... 5.......3.............@..@.reloc..6,...@7.......6.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopAssistant.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):433512
                                                                                                                                                                                                      Entropy (8bit):7.139106415773596
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:K+uQsh0TLpB9RHUlRK+/VROuKNomYjemfkUsrBuZ:sQsOTLpB954Rh/f2rmfFs9uZ
                                                                                                                                                                                                      MD5:E381639C72EAABDCBCC90BBED1508C03
                                                                                                                                                                                                      SHA1:B7DA0993B917596C6DF2B8D7D4A175A00309CFC6
                                                                                                                                                                                                      SHA-256:CA7F67FA6BA73843B7E7BA57E2796A0BF807FDA8D0444C27D42D8931E6B81FFB
                                                                                                                                                                                                      SHA-512:0A16E8C17EDB0B5E460EEA396AC1A9F43B35161532542389AA4905990AB2DE1A74B8D70ACA167D0145DEF77D6D7353DE723765B204462443448DAA4CD2E7A4F4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SL..-...-...-..b!..-...U"..-...U4.-....3..-...U3.^-..0....-..0....-...-...-...U=."-...U%..-....#..-...U&..-..Rich.-..........PE..L...y.,Q...........!.....D...B......H........`......................................ua....@..........................................`...+..............h........-...c..................................@............`..T............................text...@C.......D.................. ..`.rdata.......`.......H..............@..@.data....C.......&..................@....rsrc....+...`...,..................@..@.reloc...H.......J...@..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopMenu.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):123256
                                                                                                                                                                                                      Entropy (8bit):6.447135984845218
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:A3LTWXUh0wR0LgAd4FwoX+RFokK95ul77QDtU:AoG7R2gA8woX+RFVKeA6
                                                                                                                                                                                                      MD5:E6515A6F40AC15E0089576ADFB8BC2A9
                                                                                                                                                                                                      SHA1:57664562863873E14AA890CE1B0473FAB51BAAFF
                                                                                                                                                                                                      SHA-256:63F29E4E625FDD68D2AA3E651949CE2DEE027639E2310EE6AF3AC028F328C7DB
                                                                                                                                                                                                      SHA-512:E095FF40BC7155D379F6E37AC464A4C33A795B894E78C29062564B3C5307163CFB94ADBCE139FD4AF023532EB7315E7423E7B15201578E584FBBA23F3A4C3AF5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..x3..+3..+3..+:..+ ..+:..+^..+...+1..+...+<..+3..+N..+:..+;..+:..+...+:..+2..+-..+2..+:..+2..+Rich3..+........................PE..L...Za<P...........!.........................@............................... ..............................................tx..........................x...........0B...............................e..@............@...............................text....-.......................... ..`.rdata..+C...@...D...2..............@..@.data....A.......&...v..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopSwitch.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):149864
                                                                                                                                                                                                      Entropy (8bit):6.805058005152224
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:BjmUXnUXrZWLAV2J9wxQpxSUhEEhMfpp8a55jvmiQ3N7nfRI1C5/:3XUbZ52JGyvhEEYEM43NnfRI1i/
                                                                                                                                                                                                      MD5:18E4132F71542139764F16858AD032E0
                                                                                                                                                                                                      SHA1:84A4B69504A4E66E550A529D9F994AC503563535
                                                                                                                                                                                                      SHA-256:8498007D828D38CC2625A8C0AB9449BDCA5A0C0F430C832F1DA426EAB1960505
                                                                                                                                                                                                      SHA-512:8084C631B2A4CCDBC34A663C167001FBC7FD22F2B8FEA72C0255A2E2B8F994B3857DB7DEA90AEE865F15A8155C6B6BF92428A3D344A56EEC9EC0CF2983EF06FD
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...........\.......J.......M.....}..............C......]......X....Rich...........PE..L...a..P.................`..........:........p....@.................................^.....@....................................d........Y...........6..h....P..H...Pr..................................@............p...............................text...%_.......`.................. ..`.rdata...C...p...D...d..............@..@.data...</..........................@....rsrc....Y.......Z..................@..@.reloc...!...P..."..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopSwitch64.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):163968
                                                                                                                                                                                                      Entropy (8bit):6.612538321745
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:wyYZvF3XAa0y2GIID/eP+gJ8TbUNVPavT+Rvleb0GQ3b25WGVmiQ3N7nfRIitQ:wp61yjZ/O+gZGve9m0Gy1/3NnfRI+Q
                                                                                                                                                                                                      MD5:476B86E7D05550919702E25541927DA5
                                                                                                                                                                                                      SHA1:682D5B245C419E89C0BC4A4BC5A4D3B2BE901492
                                                                                                                                                                                                      SHA-256:F4200B1587639E6F8B64E2CDAC798E60FE64BF26574CA4D78401440B67D9D8EC
                                                                                                                                                                                                      SHA-512:BCA25CABE7008EFC174EA6C7B386B733E5098F8AADBE7C1B3B6CCAFF3CDB3E5070FCD0A43F02C6B1AB86BEE1C86A77EF240C0A7FC4A8EF1E3801049D68B4ABD8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................f......p.......a.................u.....o.......q.......t.....Rich....................PE..d......P.........."......x.....................@....................................=.....@.....................................................d....P...Y...0..@....l...............................................................................................text....w.......x.................. ..`.rdata..j_.......`...|..............@..@.data...8;..........................@....pdata..@....0......................@..@.rsrc....Y...P...Z..................@..@.reloc..v............f..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360DesktopUi.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):262832
                                                                                                                                                                                                      Entropy (8bit):6.439942220999784
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:EGRs/pNN5FBhx2k7dMboZVw128dPMbPLzvx:EJHpx2k7dMbYVw128pCT
                                                                                                                                                                                                      MD5:87D7A4C158C7859A915AF5B5BD4C3CE9
                                                                                                                                                                                                      SHA1:199F65BB350933C3584648159CAFE0B845FCBE37
                                                                                                                                                                                                      SHA-256:48A8EF3DD7B2F4367129CA765A4DE9A6FFC326978E7B9BB00638AF361882E7AD
                                                                                                                                                                                                      SHA-512:C18D8CDBF02846DB60EF34958B77E8D98822011B48A80DC9C26C372DDC77A7E9A31CC91AFD8A4EC8BC3C36F17EBAB5A2520E610BC25B338F230E5F82963D1836
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l.K.....l.......l.....k.l......l..>....l..>....l...m...l.......l.......l......l.......l.Rich..l.........PE..L...#Y.Q...........!.....H..........z-.......`...............................P......S.....@.............................U........... ...............................c..................................@............`...............................text....G.......H.................. ..`.rdata..%b...`...d...L..............@..@.data....C..........................@....rsrc........ ......................@..@.reloc..F8.......:..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360FeedBack.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):682048
                                                                                                                                                                                                      Entropy (8bit):6.167243018513245
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:/1Ol+njQJKsmYfiazL1eh/W9p8RzjTjVIR7H2g1GWHnqfyN8:UlYjQoXlafZ3sTjVc2LQqfyN8
                                                                                                                                                                                                      MD5:1990F7E22374AE81A63142C5BC54B006
                                                                                                                                                                                                      SHA1:4E4ED0C40FF3F05D76A1D3965B126C0225C61584
                                                                                                                                                                                                      SHA-256:9BC7CEA5C5CB8D77E8B07AEA0F6BBD70DFD1F0A0CD01963A4F5C971C67C094AD
                                                                                                                                                                                                      SHA-512:BDE8C4F811CB38D4AEFA4A5B4A3D9DC8A865D4330CF5AC9675CE6B3BE94C41D7DF91B76A919FA308C2A7D15968B396BFAEE53BB9845A4A5697AB16B85FA731D8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1&.ouGi<uGi<uGi<,dz<wGi<.[e<tGi<.[g<TGi<.Xb<tGi<+eb<vGi<.O6<qGi<.dp<sGi<fO4<wGi<.O4<`Gi<uGh<MFi<Cac<.Gi<Cab<FGi<.Ao<tGi<RichuGi<................PE..L...k.5Q.................P...................`....@..........................p.......}..........................................@...................@P....... ...B...`..................................................X............................text....G.......P.................. ..`.rdata.......`.......`..............@..@.data........ ....... ..............@....idata...).......0..................@....rsrc...............................@..@.reloc...O... ...P..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360Login.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1113016
                                                                                                                                                                                                      Entropy (8bit):6.641503286094176
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:+uGlpBgDHNQqYIWG5fsuHycQExuZe1g1ZOjCtg3mWiH95t4ElF:+uGlp+hYIWewcQ7e1g1KCOmWo5t4ElF
                                                                                                                                                                                                      MD5:4683D7FE36DA34D5C875615C63A780E7
                                                                                                                                                                                                      SHA1:9B8E25F57E5F2593EE27A2623571D0838B61E59D
                                                                                                                                                                                                      SHA-256:DECD4A9179E0532E02DA7283CFBEFD4F672899AE23F663F1CB40D41119A5FBEA
                                                                                                                                                                                                      SHA-512:ADEBEA3659220F22708810F5CB23007EF731E67CCE3EA48D3DE267D9B2A5DE12B1C63120DF302E299CA4E43AF3024A4AAD6E433B4F2C8CDADD0E86759D0F218E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........txi...:...:...:.m.:...:.m.:...:.m.:...:..{:...:..m:...:...: ..:.m.:...:.m.:...:.G.:...:.m.:...:Rich...:........PE..L....~.Q...........!................\........ ...............................@............@.........................p...3...t...T............................p......p&..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...Hz.......B..................@....rsrc...............................@..@.reloc..Z....p......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360MsgPushCore.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):812184
                                                                                                                                                                                                      Entropy (8bit):6.502754405925657
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:T/nhY+ZXDcGMheIibbzNRVcxr9diftAAo2V3U/tqjGrA0iarnm8JqnZDVcxANbjx:T/XA7YRy5ift421UlqX0iSnJJkZNSTTo
                                                                                                                                                                                                      MD5:7947B066A1A4B66CD2B9D086DE45D939
                                                                                                                                                                                                      SHA1:5AB237ED46904DCD43B4F0207D7CCB89E50C980B
                                                                                                                                                                                                      SHA-256:AF7DF81DC1C593591B92D6E4182A1186E9074204F6954A80CABBE42D2067CB38
                                                                                                                                                                                                      SHA-512:9F4FAA55AD701F13F7CBEFF90CA0057BB4AF94B58D3B6FDF02194382E04B698E79E2A94708684BCCE9D9F90F9649078333C2A876653C80918555FA52C1F1D5A2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.*1..Db..Db..Db...b..Db&l*b..Db&l)b..Db...b..Db...b.Db...b..Db...b..Db&l?b".Db..Eb..Db...b).Db...b..Db...b..Db...b..DbRich..Db........PE..L....A=Q...........!.........|......n.....................................................@.........................P...W.......h........C...........H..............0...................................@...............p...l...@....................text............................... ..`.rdata..............................@..@.data...........R..................@....share..............."..............@....rsrc....C.......D...$..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360NetUL.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):229360
                                                                                                                                                                                                      Entropy (8bit):6.679890430785069
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:RF494g2HDCpxH/cmBYpDIhjISo9TBVLnW/Z:Rm9OCHfcmBQnSo9TG/Z
                                                                                                                                                                                                      MD5:68A3D19BA62C6987E88CB2B7712B9592
                                                                                                                                                                                                      SHA1:E9B1C288165D09F2B0833719F7626FB39F96D350
                                                                                                                                                                                                      SHA-256:7893BB10C4291D70A48CDC3C65BDAE5D9DFE15DD3F84856CDA6A5A4E51EAAC09
                                                                                                                                                                                                      SHA-512:9A84096D56FB0C99A70BE69361FDF5F1ABE4583CEE4CB51FF12EB474CADF3CBD961952C6E78425E544F145A1FE8104B4E044ACC71A03BB30BD1A9C655E413842
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)..H..H..H..0O..H..0Y..H......H......H..H.$H..0^..H..0H..H...N..H..0K..H.Rich.H.........................PE..L...B..P...........!.................@....................................................@..........................!......d........p..\............b..........(..................................8...@...............t............................text...m~.......................... ..`.rdata..\...........................@..@.data....1...0......................@....rsrc...\....p......................@..@.reloc...+.......,...6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360TopBar.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206000
                                                                                                                                                                                                      Entropy (8bit):7.026122439366733
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:cc3bCTobhqLoUA3oLNMALssaPgLWIC5E:c9Tob8RA3o5MAfbyw
                                                                                                                                                                                                      MD5:B70E8845A3DFB674910975E6D0C061EC
                                                                                                                                                                                                      SHA1:78CE9F4F2EF5B279098756E0A72D6A988D34F0DC
                                                                                                                                                                                                      SHA-256:0F3699581E563D52A5485146CAD04754A27209484084A7B766AD99E8B3FA0FCA
                                                                                                                                                                                                      SHA-512:B5F72580068F8F5A5A5545C2959D59FF9527E21D0B8BA05F0245FE1FF8937AB651070B877836CE9761D969F1FB8484CA7819CCAF3E9FFF0BA5AC264A7C4DEDA3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y}...................................l.........K........................Rich............................PE..L...-..Q.................t........................@..........................P......8.....@.................................`........ .......................0......p...................................@............... ............................text...*s.......t.................. ..`.rdata...L.......N...x..............@..@.data...@>..........................@....rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360ZMUDetail.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):911224
                                                                                                                                                                                                      Entropy (8bit):7.0009602288643835
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:rRyVJFexWGIXwsfo5kwkBhBy67kty69dGqMzIew8xU1BOdOse7D8BwXeqpDsa1Br:rIy6j7D6ElU1wdBePkMem7KU8IkkvaS
                                                                                                                                                                                                      MD5:4CB75E88940FBBF38AA5DA0277EAA5D3
                                                                                                                                                                                                      SHA1:B259DCEC0A8CAE18012AE450EE504F680CA64201
                                                                                                                                                                                                      SHA-256:7467F2D3792F5A8A127998CD7671175646260718F26336169A8E593527926DE3
                                                                                                                                                                                                      SHA-512:93F09FCCBFAADCF8DE94CB090381837843657AA6160E381DAD1F1FF191FDE9F6408E2CF2E889D0CACFCBB9DD6659E0B9B7C458B8BCB6CFA9E35A4CD108E75D05
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h#.Wh...h..Th...hD..h...h..Bhz..h..Eh...h.Z.h...h.Z.h...h...h..h..Eh...h..Sh...h..Uh...h..Ph...hRich...h................PE..L.....IP...........!......................................................... ......................................J.......2..........$...............x.......D\..p...................................@............................................text............................... ..`.rdata...U.......V..................@..@.data....Z...`...<...@..............@....rsrc...$............|..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360desktop.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\360mwapp.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1416656
                                                                                                                                                                                                      Entropy (8bit):6.752223665132809
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:KPEeBM4l7jeAJETbXGHFW3TwIT/GBy4mX4sDLjTl2KuyJ:n4lenQW3TwIT/UmosDPTkKuyJ
                                                                                                                                                                                                      MD5:4FF9E97CEF569C059704486FFB498DF6
                                                                                                                                                                                                      SHA1:CCE58F7749AB1257595D3F84C8170218B7D2E62F
                                                                                                                                                                                                      SHA-256:C909F9799A84653ED3A9FE178963475AA5FE81D5F29CF4DE6B67FDA000C8E429
                                                                                                                                                                                                      SHA-512:FC5F8B2736D97E60BC1D73E56C5C0F7585B7FC109DDC59E4962D577C518A4C4F5A342A7CDB2C96F579E3FE814BED123B42770D8D3A3929C3C02BB58A06B19961
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........._.Ef1.Ef1.Ef1.>z=.Af1..z?.Cf1.*y;.Nf1.*y5.Gf1.*y:.Af1..D:.Gf1..nn.Pf1..E-.Df1..E(.Cf1.Vnl.Gf1.Ef0..d1..nl.Zf1.s@;.Lf1.s@:..f1..`7.Df1.RichEf1.........................PE..L...K..P.............................i............@...........................9..................................................... 3..\.........................P...................................................H............................text...%........................... ..`.rdata..............................@..@.data...P3%......@..................@....rsrc....\... 3..`... ..............@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_address.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):378
                                                                                                                                                                                                      Entropy (8bit):6.911583061847822
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDskGDVJn6dD0B3hFP/kVKqOk84kTfhZDXLk/MP+6yTirUp:6v/7i0fLkGRJ6dcxFP/kEdk8hjDXLk/D
                                                                                                                                                                                                      MD5:CC56FDFAB4489EACA44A27143AE9AC2B
                                                                                                                                                                                                      SHA1:FDECDD5969BE0F89500C6402C9C64B202A6DC4A4
                                                                                                                                                                                                      SHA-256:163DB940619596F0569EEB0B7817C799C301E9270C3BDF85445F0871C4971E1E
                                                                                                                                                                                                      SHA-512:A8BC28ED92CABD4D8102CF57A54EBB1FCF8AE2C9E080BED37D56F5BD156BC9BCA5CBF3007B66C0D86815099ACCD82DCDA900EF0169353267C82265E36C1554EB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bb``.... .OE..j&..++k...@....%.*...3.{.........Oddd._.~]../........[.y?.....?..,C-.A.d.g.dTTTd.....~...@m...AXX.?....-.....L.H.... .io.....,......L3.@f..`..T........hb..l..n.+...C .A>`.V..MM.j........?.....C\\....J.(N.Z...............k.zEEEjz...w......Y.D.:b....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_addressjk.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):375
                                                                                                                                                                                                      Entropy (8bit):7.137923455086985
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDsxHtqeQHf9FBo4ftBb++V7QJxaqWnF9xxY/51EGzHsDgTel/Vp:6v/7i0fLptq1H1FlBbiPgFmv7SX7
                                                                                                                                                                                                      MD5:679EC2BEE9EE3A3E175C191B57D6809D
                                                                                                                                                                                                      SHA1:C65ED05227FB99A41262D93802FFB246490AE146
                                                                                                                                                                                                      SHA-256:2A35A97E93752B96878C801B678E126656066EB919BC39A07E7C0AA03746950B
                                                                                                                                                                                                      SHA-512:7DAB4E8C67990336473C7CB1F9BA782E42E352182FB424E3582BD82B9C7AD0C16D4CB845D933E5A79C4A8A1568AA38FA3AFF9EE838900FD6BBED8708573594B5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.@..G].......#.....w.-.Q.=...Az.s..9.A...6...-y..@:._..};3...Xa..I..+s.,..s._.,;.Q..l.}.&... ..Q...a.8..u]......P.H.T..H.DVUu1=.i........4...Rl.1....m..M...;.......q.m.....[,.QW...F..qL..K.F....(..o6......e.a.8..e.....9.`.....`x.?1C..OM.P6.9..0.1.f..2.;....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_bottombar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 28 x 70, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):895
                                                                                                                                                                                                      Entropy (8bit):7.736770296459366
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:sS89NJziudHJ2OsjhS+lxn2EEeSEO8aIW:sSUmSHwRtSZoW
                                                                                                                                                                                                      MD5:110D93BD46D87E3F9F2C22B984319BE3
                                                                                                                                                                                                      SHA1:F4CA5A7E2838D4DBCA6B8E5A85FE31C368792745
                                                                                                                                                                                                      SHA-256:F08DEEBC0E0573FC0B30C5F169D7912C3EE683578CBB45FB8CC5273E56A17108
                                                                                                                                                                                                      SHA-512:92D7C5D1C644EC2C7EB18EAC637F327437980225B3C7DE0FDB3EAF4DDCED12715512EF3EEB4682DD6F4A89F29473F70B57B5BCBDA77549809AEAF53279547CE7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.......F.....PzcR....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..WKn.P..0:H..z....O..^.f..T.U".0./...<rfHJ............/n.~........Ao.......#.>J...Z(..~....x...."....#...A.........).gt..1...s..w.Q>.*_B...3@...h.H?...{..W.}FH...3.w...(.......+.).hK.JX[.(...r....l%.......7.......p....2.@L..hE....iX.CU...H]Q..f.A9....W...............-y.-h.XB38.8.\.)Z>........9.\n....E..d.(/...a.....[Di._....a;.........Y.i.R`o.b..4...$...%.....T.J1..M-r...QN3.u...@.5......*.d...7R..6Y...L....J....^.tO..1..u......].@.l...U..k}.U.*A....[./.y.D...............8.d...6$k9.@F.S.m,.4..d...PT..."m.[EPu..q;......:.kyk...}.l..P..K..6....".{3J}.w...^K..4N..L`..P....l........}+<......r*Y.2z.$..)....:o.$*..+V#...7a7Z...S.%6....T0.P..0(.6].>...5,.|...2..r764...1a.vf..*.bjwe.....g.R..v.`~.m9.9.`..`..=[~..{..9Od.._..h...N.9.w.GG<..&..D.. pX......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_combocool.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):923
                                                                                                                                                                                                      Entropy (8bit):7.656747347784116
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:XiAybG+xVng2RZGlVvsbZ/2AxC0hchImNd:XinHxKEZRxSd
                                                                                                                                                                                                      MD5:66E91EE2905FBDEAA4E5C2313B8FDB13
                                                                                                                                                                                                      SHA1:B844EC343F2268ECBF4BEB0CD4D15D3033D2B17B
                                                                                                                                                                                                      SHA-256:E787531C78ECF94B1BE9166E1667F41D9BFCDBBB771B9CA9D97C02384287761C
                                                                                                                                                                                                      SHA-512:943526A7CC15571AA8E37301D839FB0762D0E4F25D0B44B983A192A480DBE6C09F8FA870528119C8BB6D3ED9DB7C6391DF5EF9A9060C475B1989711E99648505
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..KK[Q..wn...VP..B...HEl....$j....I..t"..ZA...-8...:.C.*.....5..uZ%.....=.!.....9g.....9...J....`...A[$.i9==m....///s."....5.L.........ii................M...V.....H....POzk.HNN.....`...f...v...r....;!.........@........[......@..f........z..w...2...../......H4.....If...r.....C.rZ{zzBsss..@###.....ogf.+I....X...+[IIInoo.......#..{}}.....jP...F.\......{{{}....yJ`.Im2.E.B...s..?.0.P...n..k....:....Dm2..I...qZ`..@.6..NO...A.x...fu`.kP..d..!XVV.s..(jR..d....p......Q..d!....j)//.....BQ...&.X...RQQ......UH..5.EMj.!..y.......s.n...*....5.H......@._477.9_[[S....l.A.61a.....%....SSS....V.......`P...1a4...J"..X,.q8....$V..sqq...........ZONN...u..a.cTG....0....3..........ZUU...$......Z...i..j7|t...@*.....1.....P.....8"...............z:.@...A..0VO2.([...D+,...>...._...!..4.5w.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_combocooljk.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):888
                                                                                                                                                                                                      Entropy (8bit):7.608052775689205
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:wPD5/xB8ESjaqJDjFthuOB1tn9i+ez3eiJqsGNU:wPF/DBSjhpFvd1tqeiJqJS
                                                                                                                                                                                                      MD5:B0A2B5855260AEBA0BEA2A6AF4421167
                                                                                                                                                                                                      SHA1:49679525EEACA9A97D910F6F0904883838E3D2A1
                                                                                                                                                                                                      SHA-256:5FF7AEE15318830BC40EA1402131AEDAF8CBFAD2AA914A628B5BF1D4B59703AE
                                                                                                                                                                                                      SHA-512:5F9C579666EEC68A1873469B010DA5AE9739BFB8326EDD009C9D795F4EB0BEB39C4DBD634B9577C8BD3F8D5EE3CFB9CAE492A2A4728A0C49FAE969E43E216A82
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...OZa.._^P.4...A.W$!.J. 5..B...C...X..v....P..]:....4.!..!..#.....yn..i5..r..{........`P.E4.ex.E(.....N...M\^^.noo.777.ZDL&S.h4f...6......c=.Ln=.h~~...;....)../..............WK)EKK....Z........Z...O.b..'...._......Q,..........eq/...A-j>...L....!..B\W....A-j.,,<@.y.F...l.......I.^...v..uu%P.C..MOO.O.R....0.....!0....I.B..R#........wvv......m.z<,8}..../...d.T*..4...Im..J..Z.a...T.....d.V.A...`..cS....X.~....=._............@..V...lj{.....&.YdWW...hmm....d .....0.T.F.NK........}.......z.6.!P..5.........-.-.|>.6..w.jR....b..`..../.f.|tt.vOm..G.D../"....###..^o.a...V`?.f......~..6.s..Y<E..LZgg.p....ccck...."....c<..,...\.7.a+.....K.Z...../S...!.N..............vee.....K..k....V.j...}%.#.4..7...L..g.|...Lq..H..!..[..."B....j'.(..=n..o..Mv..`.S.}s..g....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_menubar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 400 x 25, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2902
                                                                                                                                                                                                      Entropy (8bit):7.854538720952291
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:U/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7pz:USMllcHitlIxv9vk7C1+I4wWHLihk/xl
                                                                                                                                                                                                      MD5:EBFE7A6895A10C867E4178A8F34E2450
                                                                                                                                                                                                      SHA1:F0DFEB6F1A01CA08F83A98F194DC7052F1913CBC
                                                                                                                                                                                                      SHA-256:1D6AFBD5A688698A73C252089C9EBB8E5DAEA31AC2F701C7E7FC52B1D207E640
                                                                                                                                                                                                      SHA-512:057DC9A7E4E60560BC3564B658FBD7EA9448C4407D64ECABCCCE32C7F8D13912A279C6A836ADB571CFC7B04DEB1D3C85CF56E1DF4741B92A6991395D6B161BF5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................?....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_titlebar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 180 x 23, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2944
                                                                                                                                                                                                      Entropy (8bit):7.867012956447315
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:j/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7up0:jSMllcHitlIxv9vk7C1+I4wWHLihk/xR
                                                                                                                                                                                                      MD5:E7854C688AFC786BF49BDD6CE61521BE
                                                                                                                                                                                                      SHA1:DEC0B971F56FF413262E4619E1610975CA6D2846
                                                                                                                                                                                                      SHA-256:5A0819E87C40D4F548301F601A44DF02BC4D2E8AB1AF30D6F7AB76C77701BAE9
                                                                                                                                                                                                      SHA-512:A8304875C2DF8C6FA2C8CA9910A867FA9285519FCA055ABBE344FFB7C61A49559ED29CCC8043666B539E14B6E6F0214B40E082BDE79AD17C58A99AAD3BC346A9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............-'.%....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\bg_topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 480 x 127, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4458
                                                                                                                                                                                                      Entropy (8bit):7.848831874056026
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:n1PinBKex0NHeZOJnKb2tUsnL6xFRiljhz2kg+F2WLXbgEmtXKm6YYwI:1KBKexBOvthsRi9hz2SGZu
                                                                                                                                                                                                      MD5:4F1705C49D8B08621D8F47D6868CE563
                                                                                                                                                                                                      SHA1:104C2E7DB170E423D34892366548C3D9FF3532BB
                                                                                                                                                                                                      SHA-256:27F4DC9C58C766D8DEF55A8859DB30DF28168817649DDBE17E710A7A72606D8C
                                                                                                                                                                                                      SHA-512:84738EC8FB0AE48554E81D427B537E1298C4EF3C9EA961F8E8E05ACED7284C3FA333F7A87B65C785EC03E60342B7E73C179E4DA5F41B4572DDD9E754BE511399
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....7...Z{.^..S.....O.?xO.=(B.PT....;..:i..R.v..Y.O...#...H.G~.._....z._....".).b.K..[..{.~.pEu.G.....v..Gv.EnY..H*.v......vU.U......[...+)...).\<-.h*J..J...-.t...].>[.{.).-.(...m.T .&...w.....z.,h.B.....,rQR...n.r.;.ii.\.\.t{d.LOP..hV.\..^9...4C....h.c.$....;I....N.]...D....K.$b".k"R9.`.n......b.RwS....R..w..%C.;.V..v....I.g..t.$4.....S_..4Q...!..d..Dkt...^k.w..$.w...!SdzR2..r...1\\t.e..tbh.?...^:.;....Ly^s1..E........rK.u&.9...cd.......<...lA.....W[..i..y.%....8-a.<..!.!.5S^..)m....6-).uqc.*[Yi........J+..m..`+MJ.._E.U`b.*Y.Pfqd.LON...Zt...Mm..V]..rcXa.&h.[.%).t...{.a..V..K.K.~.$n*H......5.<;f.g..5..s..c.l...l..)..5kv.{..3.....W.+?..K.M.....x..k_.....q.s..V..o..;.P.Yz %.P..f..{.eR.d+D..Q.2..E'Q.ce.l.L..."I.b.c..!SdzZ2..4..f|)zHRy. ....i&.T.=.(f..o....sb.&...Y..-$Z.!f1j...H...V+.......z...l..`.k&...IfE..^..S.R...1/p.-.s..V.ii.<b...P..E..7......UI"....G.z

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\btn_title_close.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 112 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4388
                                                                                                                                                                                                      Entropy (8bit):7.912014293635645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:oSMllcHitlIxv9vk7C1+I4wWHLihk/xJCb32oVZBfXtLK5e/iEuV:oSHIIHUCD4waDS2sffXt+s/uV
                                                                                                                                                                                                      MD5:D4CADB6C7F66D6EB63524A4140CA1871
                                                                                                                                                                                                      SHA1:A00C017C57AC0BB45A2CA62F7E42AE17A02B96BF
                                                                                                                                                                                                      SHA-256:B5DB14B67EF9A65951B5F48F88BBF1F9BBF860240193AB67614D09BD34CCB2BA
                                                                                                                                                                                                      SHA-512:06350530B94C26D30A0B24D1320071D3DDF27CAA30CF442EE64DDD0AF962FBC964C45BB1CC45E1C47D4870891A474B4AFDDDF5927701C2EB400E92B071922E64
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...p................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\btn_title_max.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3741
                                                                                                                                                                                                      Entropy (8bit):7.899231445675867
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/xKsCmeJ:2IIHUCD4waosiJ
                                                                                                                                                                                                      MD5:A23B225B6D0B54B8DDA157047ACE3A33
                                                                                                                                                                                                      SHA1:EE403794BF7D7B6FA7FD34FAEE982E08EDD9A5BA
                                                                                                                                                                                                      SHA-256:D5C219976828E95119B4EEE98EEF949E0D2B451B03097D0BB51633888F784A73
                                                                                                                                                                                                      SHA-512:B5FB8038993647D1D4A6618D11AC6C6F156CB8A1E8F643B5241E7C11C567D80ED753DC05AF00F6704782E40BB1746CE42AA3D9B34BEB59CBBCD321F4D9303010
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\btn_title_min.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3354
                                                                                                                                                                                                      Entropy (8bit):7.890717225229663
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/x/eiGKlWXbp:2IIHUCD4wadSKG
                                                                                                                                                                                                      MD5:30304F398F360D180CCDCD986F0E4D52
                                                                                                                                                                                                      SHA1:5840F5D00051B44B4666373711FF3D5C5380CA17
                                                                                                                                                                                                      SHA-256:332E9605BB588B8113167DF564CD0A4463701E60526EFEAB0575621214A068EE
                                                                                                                                                                                                      SHA-512:C111BFE0C6566FEFDFFD107DD4BFD4196EE4DFAE87EDF0270FE3397078769EA34B9A2A44BA6A42D65A628C847B95D67B6E328AE86F586E625A02520932C633D1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\il_statusitem.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 208 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5267
                                                                                                                                                                                                      Entropy (8bit):7.956195186420475
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:finFlEbEhgZPgh3wBAep5ljSECEDAUQCUuhPldTCzpslcfMl/Bf:firkMxEAwma3ldT2aln/Bf
                                                                                                                                                                                                      MD5:2CFD765005431ADAAC5CA4C9FE73ABCC
                                                                                                                                                                                                      SHA1:99A1ADA7BE44393E827E9959C536C39043CE6637
                                                                                                                                                                                                      SHA-256:98C36162E3F977B1AE6E68CCEF6A6541ED2CFCB6FB455E53CD24D1FFA7FE55BF
                                                                                                                                                                                                      SHA-512:2AF338B4AC2A495314E5ADD13C36AA2FC40D6929C8EEA77B89F06FE5EA00986A4BF4543DEC7DE5C19F7E16737A4AE50693663E8CC80AC4A996C5C5AF750A8BA1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............gL......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...%IDATx..Z.xTU.~.d2..))$aR ...`(J.T.....?..,....... R.].D ......$.l.4!B..$.J.$...s..3.Ld.g.}.=z.....)..}.w.\........~^....Z-...r7.CmueT.B6S..2.'...;...57T....F....!..e=..@..L............"...m.U.pa.^......w^y{.{.H.......W**...J....x.X,..{K.[ ......L.....""!..C'....V.Z%..l....7E$.......u..M.6..........e..aw....t.9l...4..Y.....4...@dP.Z.......o.......B......I.x]s..S.....^..l;..x...h..,a...#.....f.Xb....L.Q.xh.n.k.y'O....8..S.=.O......[...o.:.U~q_.."...s.....G.9l=.h........=.......9.y.f.X...1c.@....^n.5X......a.l.m...e.?...&..b.....{o..c&..........d.LH..FL....).l..OO.?....v..0..$&..Iw......t.w..H.8.......a....kG.Um=v4}..=.O......j?~.]....D....}\.Y...y....'.,Xp[X..i1B^p..)I}..+.&..*U.9..o.c.d..7h}...B........&)........L.;w...co.wv....}^t..z*3}Qg...h.T..MM...-;.1a....7I..K.......i.3.'.P"..L.Cll\;.........1IPxU.6....pX.`kT.Q.bL<.m.A8S..j;..q....@U..2.LiT.>s.:..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\img_sideband.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 4 x 49, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):158
                                                                                                                                                                                                      Entropy (8bit):5.71235322396329
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlJOtEll7ncl0tRthwkBDsTBZtVdEAX22SQPx+PhitB1p:6v/lhPatE/gl0znDspVmATEPAtjp
                                                                                                                                                                                                      MD5:5118D10C7EACE902540AC439524318CF
                                                                                                                                                                                                      SHA1:4E077F9814418BFF4180EB0EE01846739D8524B8
                                                                                                                                                                                                      SHA-256:1A4D1DC5012178110061C72F88B019E59428744D5B98FBC4862945362ED217E3
                                                                                                                                                                                                      SHA-512:1AE78BB7A49E49EAC6CDA168202C35C3B7706DE545FFC89EF765FF4416C4EAE8D205DB7EEA815810F53284C71BC67F5FFB0E83A12C417BC909F33090F4DAF051
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.......1......F.`....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...0IDATx.b...?.2`...W...t.R.\@]].AOO...qT..Q-P..`.............IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\size_status.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):211
                                                                                                                                                                                                      Entropy (8bit):6.330054257939168
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP8AMzl0znDspvsKhlyVQ5Yn3xJRyr+px/bGX+lVp:6v/7kAMpLhhlyVQGhny6XEA
                                                                                                                                                                                                      MD5:A5099D3544E5202E9AEFFF353DE2C999
                                                                                                                                                                                                      SHA1:026DEA383560874AB38DA3E192F2241E3CAB9F60
                                                                                                                                                                                                      SHA-256:6FE17CDB2AE87788220F6D44551A6918111AFA6D1DB20E0BBD050CAD418DC7BE
                                                                                                                                                                                                      SHA-512:09F87D3D4660BCAF98AC6D9CBDC24A59230FF4A7724C2317FEAC61D196EE360A87A1270A1C4C8FD41B6EE647D767E7BAFEB55EA1C517B962460BD33F78FFDD02
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............w&....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...eIDATx..... ..@$i.:,.h.7..F|d|.x.nX......^k.Wk....).L..8a)%......Q..Q..y.#3...G8;....~;.p,........oO........IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\skin.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5489
                                                                                                                                                                                                      Entropy (8bit):6.585852073568794
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:0rEQE5pOV22c4LeR4Vraj7mKZTM8sAT8BDRYknQloo9AoIkKqIy/q:0rEIVxc4a9jv9Zoo9AoIkKqXq
                                                                                                                                                                                                      MD5:E1398061A627C60593085CC1386B6C68
                                                                                                                                                                                                      SHA1:647E88E4A8B910229F8C7FE76F2D4B783FCFD648
                                                                                                                                                                                                      SHA-256:B65FEE9AC2F2115808424515EB04E5D0FA10709758CC7E95DF01D355CC00D5A4
                                                                                                                                                                                                      SHA-512:AAC734FF7C9F0A8032365F57B8AB861F096A9FB3BAEF0EB32616FADCDDA630082F2683A48C2E6A790C738D745B2B9917BC2ACEC98CC6A695B62EC7528ADB569E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:#read only..[General]..Name=Azenis..#.........Author=JJ Ying Create, Breath Modify...#......Comment=A 2006 GUI Champ Best Overall Visual Style..#......Version=2.0..#......[TitleBar]..Height=23..#.............[SideBar]..Super=0..AlignSuperTitle=1....[Rebar]..GripperCX=6..RowLine=0..#..................0......1.........AddressButtonSpace=0..#......................SearchButtonSpace=0..#........................[TabBar]..ItemLeft=12..ItemRight=12..#.............................................#................................................VBorder=1..#..............Y...........PBorder=0..#...........................[Browser]..Border=2..Spliter=2..#............................................[ICON]..FAV_DIRECTORY=fav_directory.ico..#...........FAV_URL=fav_url.ico..#...............ADDRESS_URL=address_url.ico ..#..................[IMG]..BTN_NEW=tool_new.png..#...............

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_bg.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_bgb.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_btnclose.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4467
                                                                                                                                                                                                      Entropy (8bit):7.887524585572367
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xwfKkLVVi/xMQye6DWfaKl:dSHIIHUCD4waWRVVwMCnzl
                                                                                                                                                                                                      MD5:D6C5EA4C704DA7C98288EEAE2C4B668A
                                                                                                                                                                                                      SHA1:C55548295A566EDF4FB1047D6543CEF93AA7D792
                                                                                                                                                                                                      SHA-256:FEB9889385BA65246180CC47694BE22B81344B4141383C1F5DEE565C249ABF84
                                                                                                                                                                                                      SHA-512:004EA99AD6027AF356A7CE01ABEFEC9514D5BF2ECF275B1A72C0C44F631EFE10599CFC0AF48DE06516C2784D56FA59D406C8AC20DDE5C285EEB7EDBA93279642
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_btnleft.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3641
                                                                                                                                                                                                      Entropy (8bit):7.901710647211874
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xQJWHAFfvUmyhpy:dSHIIHUCD4wa+WHAxhOpy
                                                                                                                                                                                                      MD5:B112B85C2FA8B2520A5F0D5D63E19E63
                                                                                                                                                                                                      SHA1:991841D56BEAB6F9E01810510C14D18EE992C5F3
                                                                                                                                                                                                      SHA-256:EF7BE34F2A38FA86C0A01A65CAD72AF086105EBAE136F0213BD10F86022F7473
                                                                                                                                                                                                      SHA-512:45EA3B364D7E37886804067D160A3C066C038393D2FAD55A18DCDC65D3A58E38903AA1F41D8455887C4F4A9AE069E3478753E4180184E99C602B05C135A563CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_btnlist.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3429
                                                                                                                                                                                                      Entropy (8bit):7.889410060546279
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xE94bNjeIW4Ntv:dSHIIHUCD4waRQInD
                                                                                                                                                                                                      MD5:7EC39872A2DB36E8915D6AA8E2F881D5
                                                                                                                                                                                                      SHA1:224A440E2B0660EBCC89C3AD9A880A08F57F7D16
                                                                                                                                                                                                      SHA-256:E8FF2A17DC40ED150B1E53331C131190D7CA3ECDFBFE995E4226099BD66FA406
                                                                                                                                                                                                      SHA-512:CD32E9704BDE2462F2B411489F5DBFA974E3D00B37A0C81EFD524F2E006A7773F4A2ABBDC9AE9363E3C20E63DD54EB550FC3E8BB574496996A171B0AD8703E5A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_btnnew.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):786
                                                                                                                                                                                                      Entropy (8bit):7.546808003957644
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:LmaCT4VwffCMlEJ/ocRnaqxnZVXPcs20C3naWrhlm:LmSwffPyJRaq7VXP520C3nbdQ
                                                                                                                                                                                                      MD5:0B08617981E18967F72525470CBF3E77
                                                                                                                                                                                                      SHA1:2A79C7EADB99B2ABE4BACDB534369C9F048AD37A
                                                                                                                                                                                                      SHA-256:853D1856F1BB147DA4F791C187FCBCDD70A677E49585BC01F9FEDCAB297A6567
                                                                                                                                                                                                      SHA-512:86A4D861645EAC50DFE068AD5DB567FDBDCED333908A24BA2AC1AF40098971F6636975615309F6F167F3C3E7503F912EAFB60DF29E75360155BE1F0FEF367052
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...`................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..ZO..@.....<$....."^.R(.)...........=..So...~.~.^\X(.x.\*TQPH.....4....d&..<..A.o~.7o2...n.DrPe.....EQ.7.fS.....t......D.N........X...d2G...P...r.?.tP.#0..7W.Uw:...pH...D..:)..$...M..I\.......dB....m;..a..R..B.@....t...lFF.Q(..R..r9....V......~....H..b..j5.`.....{..kn...z.....i.m...V.0.h..h..=...*.....(..@.G->..p...y.....p..y..-....@.#vx.\.>.......py.Hl..A3..x\.&h.....q..../.C.9@B.9.X.....W...W......Z..oo..G.v........E.Ae.^...._....F..D...K.........8bc...w?....;,.<.._.z...>.z*.....?#....H6v...........?......>......gc.W.%.....0z,..C Z.......R...._..X..M..xQp......8..l.8..;..Q.....v9.X.l.....?..D.>u...C%.......(..%W.4@B. ..H.......s..E......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_btnnewb.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):305
                                                                                                                                                                                                      Entropy (8bit):6.175730934146871
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPkl/O/6TMMAYfvl5uUdHlOx815NwNYZbbhEzNoPoopj32OpXp:6v/7UO/6TMqUwEx81/Z/66dcAZ
                                                                                                                                                                                                      MD5:0408523A403C234A6FF5A73AFF360BE9
                                                                                                                                                                                                      SHA1:309304547079031CC9A7FF87C52BBD55CB82A68F
                                                                                                                                                                                                      SHA-256:4EBB1B2E9B7C5D035637D980BD08C67DB341B8CC1C3337E7D07774E2650CD1DA
                                                                                                                                                                                                      SHA-512:92C3D04F97C402BDE63532DAD510BB467409591BD140BEC0665952D49653352F577B0E3FCAC7B5FAA7964EC81324B6EA67AD3AC0F823AEB52C7F25868DD2E778
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...`................pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F....IDATx...1..0.@.x...8y....G..B=.....P.B. %.A..\~J...I.1......@.. ........l.<|.O..|..C..?>i..m>.wz.....l...M.u..g.DM....Q...=sd.$H.......?$.6...@.. ......@._.........0/V.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_btnright.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3664
                                                                                                                                                                                                      Entropy (8bit):7.891018711426157
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xjntMr/R:dSHIIHUCD4waRntMr/R
                                                                                                                                                                                                      MD5:716E2DC65E20E05219E10C230783356F
                                                                                                                                                                                                      SHA1:30B0C796C5AD8D3B623F7D67F6F974F07A61FFC9
                                                                                                                                                                                                      SHA-256:1F2F895C8E4CA97F21B31C0C6403AACE8F4339D92980B7A79B53B375CC85C8FF
                                                                                                                                                                                                      SHA-512:A137905D889304948059647ABF87A1623321A01246EE47E8B89816AC49CD69927D1D60C0DCC52F408F0C413205AE637E2B3BAAB75D72D4DFF2C1CEDA6FAFC26A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_close.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 69 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3914
                                                                                                                                                                                                      Entropy (8bit):7.895999769181624
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:ISMllcHitlIxv9vk7C1+I4wWHLihk/x7a8TnZO83:ISHIIHUCD4waj
                                                                                                                                                                                                      MD5:0F48448630F47F51E9E309B7C88109BB
                                                                                                                                                                                                      SHA1:60250A7CCB0F464DE5F3FFE60C5EA1596A997BC8
                                                                                                                                                                                                      SHA-256:3E439DDDA28EC24F0DCCF14DC427B874439E9F7502F8FDB1315E9180DD949BCB
                                                                                                                                                                                                      SHA-512:245F230F6AB9062E9FAE8E90703CFF77F22D2681C584B9CFF6D6B89FCA97E1C778B87530C4FF7ABE802973207D0DD00617082B017F6D820386CEF9801D881207
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...E..."......|......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_item.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3722
                                                                                                                                                                                                      Entropy (8bit):7.899224106584947
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:hSMllcHitlIxv9vk7C1+I4wWHLihk/xrXwL+o9qjbdc:hSHIIHUCD4waRg9qji
                                                                                                                                                                                                      MD5:45FEA5118EE9A74839DF56DAD84F56AB
                                                                                                                                                                                                      SHA1:A0D82C69D219CB8CD1404EB0166EF8B8C748B53F
                                                                                                                                                                                                      SHA-256:43E59E4ADFE9DAA9EAD1ED41FA17C6DC8056EB14FBE41DE60F4FC7A665BC6E93
                                                                                                                                                                                                      SHA-512:5ABD0174FEC6B8EC0AD9B0F38F52090958ED43837925F34A9136F9C60558B2C99203E9E13BA0761D2F486CA7BBD078D1CFF2E053B533A92D3100A6236C061F88
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tab_itemb.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2608
                                                                                                                                                                                                      Entropy (8bit):7.882785296810761
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:TDsqWxNpSU9R+FkrZaM6UbI00CGGLS3fIOYHfmonECkORJGk56JFPxGjfknTGIh/:TDsq0SUHnaBCQCGOS3yHfdECN96JFpWc
                                                                                                                                                                                                      MD5:178B8BDF1962943FB5DF07AA07A99250
                                                                                                                                                                                                      SHA1:A8FE3CC3BDB2F33751EEA61AD8717E00FAD4546D
                                                                                                                                                                                                      SHA-256:78FE192F2FF86421B48ACD46BD1CD78D319C47007ECF4BECAAE4F4B82C86F074
                                                                                                                                                                                                      SHA-512:DBCB024A2BCCF977AC148F8D4E5923F181ECB217B19DB775CBC9F4668CC9F31B0897BD816FE76DC98684EC6D9316F573E1EF40D14D94E3A79EF40D9E3CDF8395
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[Ko...>w8|./..%.l...70.....].(...MV.......?h.n..@..."....]4M...$....%Y.H./q...3s......aj....$........sy.I)a.f.M......4k.....Do..`j..>K.cd..<B(.h....b.g.Y...8D..Z...,..%..giD.....Ek).c<.D.)P.F.....V.V..hy....(.....F...m..5.:.x+...,}..3i..gVM.@...wZ.......5..j...!HJ}.<..khw.^.pc......g.J. .%N>PN.B.L..6..*...f[.?..+.....DqS.0.J......8*K.]/.g...eV...O.....i.Z..x.!.....9...........Y.)Xh.)........}....w......&...+._.P.No.../.7n.....@G*..@8...\~i......-..P,.H...GW.4.....n.uXn....|..5.0~.}....7().s.....T^.....x.B<ow:.).....y..g......o......a.....`.",WJ.^_......4.....I`...+P...u.....w...?.vk.M..h..&........7nf...A.....r..|v..>|..L...ad{G..?.D1....#.S.....y.x~...}.$....:.X7...v..7.C...;.\.8.}.8.S."O....4.D.\..o...^.....-......;v.J....B......u...5....S.s.a.........T.5.@y<....<P...K...Pa....^..A...R..y..@..+M..vHd.6........|>7..K........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\thumb.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 60 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):518
                                                                                                                                                                                                      Entropy (8bit):7.326106620215251
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7GLcAAqRUUpp359ikkBi4Q8pnTZtEWUQqBugrt/73:AAF3/359iq4ppTZtBPtgrtj3
                                                                                                                                                                                                      MD5:A19117ABBC4882C42E88A2C6ADEBBF80
                                                                                                                                                                                                      SHA1:A1939BE01CB3818BE8C4F37730BAD3E68504BFC0
                                                                                                                                                                                                      SHA-256:432616E5DE7157AE72488B761F15820841111E261588404D6DF558B15D80AF50
                                                                                                                                                                                                      SHA-512:6F2C9B881694FD621DFBB418B45953D132D21A8989705B406A8FE9F543890145167B1CAECB36DF690E5285673978CFC7A1983D9836FB93CA49E875C4CABD447B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...<...........?Y....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.H.L.#..zx........+V.S..6..'\....T..Ak...ZTv.5..a.*;p......8h.yX......@i.t..?...b...3|......`.....gg.x..b..4g!.....?3|..........M.y.z..>fgg.?x...gNI.............RSS...999.W.Z.i...R_.....W.--.g...d../B. ..A..I.;.....?{..=...4...i^hX......._2.....Y.."...../.^.d.6...t. ......\.........eff...rp.WRR.....b...hKk>.[Ft5o...Hmi.r.JW.rss.N-0._.....y0._.....y..C<.....G=<.............(.F....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tool_go.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3112
                                                                                                                                                                                                      Entropy (8bit):7.923572389677524
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:n37DTYmEYkOTrzGzTb40tllVYbG5DCAatTSytJtSak48ShiGJjAHs+zn4YiZCXEI:rDuYbITk0tllVtdCAaH+aXNhitCA0Qnr
                                                                                                                                                                                                      MD5:8617CC17BF0424619372F86C37EAF521
                                                                                                                                                                                                      SHA1:FA3F25348D619320F7642732A925B9875EFC077D
                                                                                                                                                                                                      SHA-256:C474475EC789A4C47972015385A8D6AA74289A9B6A995380CF32940E9ED0FD54
                                                                                                                                                                                                      SHA-512:E716D8B66C2CA7D55C1B3B133A8CE821F9DB9164FE6F4B20F763B2B60CD8A2182514E7CA781C7C85C9B8AA8CE4FE787664BF8DD34344E5B22CB5B2D896F035E0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.o......v..v.m...).i).}...XS1........a.~.J[...........4...c..n%.+m!....&m.p..N..........$d.l..Gv._...{...s.l6.....p..*...%..&..`....A.."$.1B......$.g.E....q9...i.<.P..`#T.j...B+.......c.A.9B?.O."..Q..t)%~).X.r.A...v.6.V.[....}...>.x.U.-..1<te...........K.WwF.....e$&>E*......mp.s..7n67m..]s...$.....+M-..Us.PR....u..]k.b..5p..U;.V................... E./Rq2......auS.....UU2_8...s...ap.#....H..s.P....\............z../...;.Ago8C..'..|...X..ZR.....GM...h.s..Z."....82...j....,V+..j..C...p..{......7...........}.9.p..<>..Y,...'...!....>.....F..j....5.42.3v..X.|.....e.[...+..JL.%...Iy..[.tw....j...H..3.9.e..4j5.f+\u.........CW.u....<.wp....{...^.p(H|.9.T0..p.............._(P.J.y....,..;..'.E.>.[.#.._...,QR.pY......-..w...ys.A<.@".(...D...a.J.{...d...@9Kd.m....;s|.>.<.B......g...@.%j...k.Q.<.G.a..{..|.O.@.h.I.x.n?%\.b..e.bx.WU..o.dRB,......_~..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tool_search.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3841
                                                                                                                                                                                                      Entropy (8bit):7.936794890178898
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:EiU+SxOJqQDBX4FQYoxhTr/MWJThCI5dY/A7nSX2gKgQ6:EiU+SmXRhTrkWJThc/62
                                                                                                                                                                                                      MD5:387BA64C9F45FEEF2E10A7ECEE89CEC1
                                                                                                                                                                                                      SHA1:FB01461E47D36CBE561BBEEBCCC8A514082C5001
                                                                                                                                                                                                      SHA-256:6813B8D9C948189546C6A2455836E1A125CA9962C7890882473C55AD4B58B3AF
                                                                                                                                                                                                      SHA-512:31E2B9B5DBEFAA35B69B3F27890A11E6FB47DB346E79B3722ACAFBBE222A60CD7996B42E0DC56B75E6905EB41902FC5F9398CAD18809114FCDA29ED750365EB1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.P..u...d.....)...!.....$..L].r..{.i:.t:u..L3.&..N...t.I...T.*'...*....-...I...<..~.z..x..*c..&Wsf.....s.=.|.+.....8ZwZg{,!...I.$....^...*.9... ...K....}H|.#.u.O.T.k.S....'...d.d.d.4........w.$#$}$.HzI.H.$n..0dt.#~*..m.]F/....4....n.\ 9Nrhrb....Q.e...c...1.'...F..........<...E...#..M,.!/W.S...X...d.6evy7=.+.9....^.Y.#J..B.p,...$/.{eU.JK.....L.......Fm6.Zo...5...v..."CZ.i8.WTT......%.........uc|t.....w.....p<2..>!4.yj.uf.B.....:...P.......l.a.V(..G..;I.I&.7..=q!B..$.m6..:W.lAm}..r..n7...b...R..*.tz=..Lz.G...8{...SS[..|L.m6.;.[...>... ...`x:.22.......S'.011..........c.["..[..v....|..l.6t.5.._.QaL.1(....$.}..R..e.....p...D...9...A&.B...$....>v...nv...<..R]].{u..d...].........9.-..!t.^_..2.4.JD.Kz.[.q_}.]}m.>.~...Q..f.WH.)..Jz...y%...m..{...eu.....E&....`.B....q....h.*...Z..."....b..n....y"....m..<....F(.K.S..H......c..q..F..%<7.d...i<..........<...u.z

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360mwapp\skin\default\tool_sidebar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 136 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2980
                                                                                                                                                                                                      Entropy (8bit):7.904587672083421
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:XVxfPDO/ZqAS1dE6lCxzZMG5of6V+QZ198lcenvmUL8e2UsJXk0nxGEngbdFJAt:XVxjQbwEACxzZMGN+QZ198m2NweCNxvP
                                                                                                                                                                                                      MD5:E7FB4B50E574A0C6BCB91FF84A05CDDC
                                                                                                                                                                                                      SHA1:71E7DE26218A926857D6D3F24F9A27FDB7627ED1
                                                                                                                                                                                                      SHA-256:050AFEB2AB763D10D19031DF07F50E10C10A4A30EE969A9E755AEFB1FA4DB77D
                                                                                                                                                                                                      SHA-512:F404316C768335C5F55EEAB567751975AD8C8253CAF78EE172FAF201F33790714E404F3028BB8C5316187492E035B938AE5C186023BDAF3D740A30ABDFFB8B5F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR..............M......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...6IDATx..[[l...>3.W...5fmc'`,.K1 s)...&..B..*.D..RHJ.PU)...O}h.P).MS).$/q...+..C..&...$P.16..efw..s.3fm.....HG3....7.|.._.1....#..a^.S.e!Jy.....Iv.\@9.6y.-..<...r<.q\.e.Vf2.P.....CL@...z...:.{......i.........)...+O.>}.0..W.P..],...v.~.....y...PVV.3f....8|.p .......P.r.,T.....-l...}.........Y..:...3....d....K]].a....QS...9..........3q...#G........h.j.6........O~....o..S..F..-H.RP..}..'....B..[.N...t:=l.>.......c...o...a..K.....4.....&...eY.h...=....s....r...q......_t/........../^>....f.....6...4..c....w. ..8..D.U.z..c.X....../.u/B............D..^|.y.....g(...,`. I.`...E......].$..;...q...O..Mi.S....H=.m.dy..W[0Z,B.e.0k+.?."....y....n9y.....K*}...Fxfs..psu.C.!....u]<y.M..]..Z ......b.*o5zs.F.E.r=F.......~av]]K......^..Q.k..As..s.... .w]:u.....42........X.|9,Y.......v....{.Bgg'.ji..?..B.|....g[..Z..n^..'?>............".. xp....yuuk.uu .SUU5..&.1.f}:

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\360wapp.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2055344
                                                                                                                                                                                                      Entropy (8bit):6.501574992303422
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:7TmiYzj+x7bTWqC1QRmQ8KeIzHlyaZL3iY4AUrnGs/RLIHfs2lFfjErTztWCCwu:GiYQj5sIvFyeCZyHfs2Lfj8tW1l
                                                                                                                                                                                                      MD5:2EF1EAA12A6DB2793C2981DAF6E5D885
                                                                                                                                                                                                      SHA1:FBD587CF30AFC8CFCC6B579D31FD390E05E5A105
                                                                                                                                                                                                      SHA-256:E0358A4AF7258EA9901120D18EDA96F027E879A72A9CB3E5AC3D9EA183916AC9
                                                                                                                                                                                                      SHA-512:F9F0917DB1379032577D423674B69E796E9BB72144FC28DE5D86EDA473D8572E3ECF040DAF95CD20914C7E5F40387587A1DD060E632388AA82A4D5653A52748D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...h...'..._...'...u...'..._..n'.......'.....'...'...%..._...'..._..,'...u...'..._...'..Rich.'..................PE..L.....Q............................T^............@.......................................@..................................A..|.......pJ...........B....... ..TG..@...................................@............................................text............................... ..`.rdata..............................@..@.data....V...p.......X..............@....rsrc...pJ.......L...h..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ACS.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppCenterCore.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1157120
                                                                                                                                                                                                      Entropy (8bit):6.505465407208107
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:kMsqyPFCyyLIyN/VowTqLbz4nt9GIy9knbKHbgHmbq032Q7x720WNmrtYVhapjUI:pwPFIIy9uwV/NYsbsbqV0WMrtyDGD
                                                                                                                                                                                                      MD5:3370C6FA90EFD8CA5C88E7DB8706247A
                                                                                                                                                                                                      SHA1:1BA328300E3021DD1AF86C27E7E5A6436C4F1EDE
                                                                                                                                                                                                      SHA-256:6D51C3DC16D1876CB4AC691BDB49C3D662F76C92F423BCBB1497B3D07AA831E8
                                                                                                                                                                                                      SHA-512:E4328F0420807ECFE586E8BB597134C80BC107106BF41A5E35088706ADA545C89A81F199B88155BFA1EB30800DCDB80F9F2636458C03CA67942EFBEF30624A25
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E............................#............V..&......&...............n.......................Rich...................PE..L......P...........!................sw..............................................6W....@......................... :..v...l...................................X...0...............................H...@............................................text...L........................... ..`.rdata...J.......L..................@..@.data........@...n...*..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppUpdate.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):209864
                                                                                                                                                                                                      Entropy (8bit):6.5024107808001474
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:CA1daG2oc26b4J+kxQLuUWyEefSut5GgzLhsbeOjunR5+hGv7drG:Pd92oczb4lx5VydfSut5UBSnCwrG
                                                                                                                                                                                                      MD5:4041E2D714BB833F85C49BD952DB8D70
                                                                                                                                                                                                      SHA1:4BA4D999FF511D5295B5CD3DC6A83F55442C595A
                                                                                                                                                                                                      SHA-256:B7E10B3B16A7E10CBE310C2213268467E63D2B50E1CC54754976CB1B020B28FF
                                                                                                                                                                                                      SHA-512:AADD060D0BF73969CAF0F985FF8895BBA530E3968A0AC53D12C890466840ABE7A241E120F2BDBDEA23BBD62C36584419CA86A910C9A1508C07C892AEA1592B02
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b...b...b.......b......tb.......b......b......b...b..\b.......b.......b...0...b.......b..Rich.b..........PE..L......P...........!.....T...........Q.......p............................................@.................................d...d....0.......................@.......r..................................@............p..(............................text....S.......T.................. ..`.rdata...e...p...f...X..............@..@.data...\C.......&..................@....rsrc........0......................@..@.reloc..h1...@...2..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\AppcenterData.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):665448
                                                                                                                                                                                                      Entropy (8bit):6.307152211676421
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:8ewM5egdD0nHwv1KDs4fU3Sd5H+pscGKsyClZ9Q17:H9TdDicDYepsJKsBQ17
                                                                                                                                                                                                      MD5:2C6A3D174572D20AD836EA64CE31EFC6
                                                                                                                                                                                                      SHA1:9CB1D008A248E6806D5548DD960B66C68CDE0BC2
                                                                                                                                                                                                      SHA-256:C4DF348797791A91A3ECF05D1375CDEB26188B4273F794041A67A2FF4D50783A
                                                                                                                                                                                                      SHA-512:85A1619C5458239044EEA9E4C56B129350CA4D7E844FD74648BFAA18705F8055E1A01FB34280746E3587092F2A72632B922683EB37BF0D7D7C8E7DD964F2709B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}=J.9\$.9\$.9\$...I.8\$.'...<\$....8\$.0$.. \$.0$..\$.0$..v\$..._.6\$.9\%..\$.0$...\$.0$..8\$.'...8\$.0$..8\$.Rich9\$.........PE..L...uz.P...........!.........v...............................................p......a.....@.............................................................h........W..P........................-......p-..@............................................text............................... ..`.rdata...5.......6..................@..@.data...XG.......&..................@....tls....I....@......................@....rsrc...............................@..@.reloc..8u.......v..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\BizPluginCake.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):198104
                                                                                                                                                                                                      Entropy (8bit):6.617352366925133
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:WRs3qPoZ5nmGk66yCXeyqv79VDNLcYHrwDzM5d5sv0oSDnzBTfn5D8Xjs8:NfsBqvJFe2rwHM5d5svFG97dijs8
                                                                                                                                                                                                      MD5:1A069A853EF0B9547D10C9E55624BA23
                                                                                                                                                                                                      SHA1:47FC9336E7DCAF28BF699AEA213E87CD8EB349C5
                                                                                                                                                                                                      SHA-256:A9E66ADEC4C6910A9A569F3EC6FD40B415FA37AB395C09C679DFF84C0D01DEB8
                                                                                                                                                                                                      SHA-512:6421533452420A19DA488C7E1B1D24F59E9BEE7B70FFD898B361758B4444E284E2549A38E7ECC8D455A6A4A673EFE41DB60A778BB8E9689582096087C5FBB2B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.V...8...8...8......8.....8.... .8.<XC...8...9..8......8......8......8......8.Rich..8.........................PE..L.....[Q...........!.....<..........*........P...............................0............@.............................................................#...........R..................................@............P...............................text.../:.......<.................. ..`.rdata..OX...P...Z...@..............@..@.data....:..........................@....rsrc...............................@..@.reloc..|(.......*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\BoxUI.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):894824
                                                                                                                                                                                                      Entropy (8bit):6.52386078019351
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:FB/l9ImbX0RJsEZ1h5YC8kFjg4698fng+Ae8niUP6ZMlvj0+nduqpWTyEd7ml3:FFTgsU1YWEnEnJAloZMlr0vq4TRml3
                                                                                                                                                                                                      MD5:8D42784F8758FFEAAECE44B131CD8C76
                                                                                                                                                                                                      SHA1:455E4E7175EEA90C625EF99336856460DE77333F
                                                                                                                                                                                                      SHA-256:378D1DAE7BA0C554F354586589F56FE818320C46537A1004475F902EC205B082
                                                                                                                                                                                                      SHA-512:A5F659423112CA7C65DD8759C6C1E1DBB041F4DF9594FF0CB679652D03ACEEF17CC8CBAC7D2B9CAC749D6166B5AE74B0180BCCB82F323576669A19285C9AF7A5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................e.....e.....e............a.....w.u....p.g....p.....~......f.....`.....e...Rich..........PE..L...p..Q...........!................(........................................ ............@.........................0...N...<...@........S..............h.......\.......................................@.......................@....................text............................... ..`.rdata..~S.......T..................@..@.data............T..................@....rsrc....S.......T...>..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\CatchScreenTray.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):531400
                                                                                                                                                                                                      Entropy (8bit):5.943047165437147
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:YAPBD8ItjByZ3JeByKzdA0CmWZyYNgHQ/E5g2HNnqOr7bg:YAPBD8ItjoeByQSMWZyYNgHnq21Zrng
                                                                                                                                                                                                      MD5:5D769795FA0B32B7E7AAB82E6F87CEDE
                                                                                                                                                                                                      SHA1:CF780D816C495758C0DDE8B96733C585D6269F84
                                                                                                                                                                                                      SHA-256:74B38BFD569F1421F29BDB0D34F95ECE9442792376A337E45B98021CC4E5E37C
                                                                                                                                                                                                      SHA-512:18A5BBA59FA14F1F6E772F6771E670BE9A1FC3581AC56E9444E2B56807D385F85F8FA663042CC61582C4B5E3C70AC76B43ED55A4C8185A46C45604265F543A17
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.QKe{?.e{?.e{?..4..d{?.l...{{?.B.Q.d{?.{)..a{?.l...C{?.l....{?.B.R.g{?.B.D.D{?.e{>..z?.l...;{?.{)..d{?.l...d{?.Riche{?.........PE..L......P............................qz.......0....@.................................Br..................................................\...........................06.................................@............0..t............................text...)........................... ..`.rdata.......0......................@..@.data...@........h..................@....rsrc...\............N..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\CloudTaskCenter_naive.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206656
                                                                                                                                                                                                      Entropy (8bit):6.533353933032578
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:7pug/0vD2hdIdDNZ6oyY15afle0TK58x3lap:7pug/YKTAAoyE65la
                                                                                                                                                                                                      MD5:BD0A2A0341F0C0CBE91ED912DCBB62EF
                                                                                                                                                                                                      SHA1:7DDE8B27275CD93053D98EF3083B262A395FAFED
                                                                                                                                                                                                      SHA-256:B4DFB4A0970548604908372F43783514D17C021C2AB65D5C12E61FB0B38C4B5D
                                                                                                                                                                                                      SHA-512:AB390186B9190A29445BAC113636E9F613B3E4E2E77BF82406ADCF99EB1CCB10E1605C1D570A3522B15F1D723932F604E4422DB76749D57B7A9D635AA855593E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..k..k..k..,k..k..:k..k...k..k..k..k..=k..k..3k..k..+k..k..-k..k..(k..kRich..k................PE..L...F..Q...........!.....\...................p............................................@.........................`...........x.......................@...........Pr..............................H...@............p...............................text...7Z.......\.................. ..`.rdata..ZY...p...Z...`..............@..@.data...d...........................@....tls................................@....rsrc...............................@..@.reloc.../.......0..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTCrashReport.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):253616
                                                                                                                                                                                                      Entropy (8bit):6.269768372575183
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:Luf0V9jblulC9FT2saGG1VLErK2RaqOv+TBRjp3L:Hug9FT251Vz2cqOv+TdL
                                                                                                                                                                                                      MD5:5DC6B9FBC85018A912A166C5B7C6515E
                                                                                                                                                                                                      SHA1:51DE39B4CBAF5F704464EF43FD89099D96A540B4
                                                                                                                                                                                                      SHA-256:BAF48D4858CF440C64A617EB6FB0DEC7FA821A7136DA9D89A2FDE43CF09EB95D
                                                                                                                                                                                                      SHA-512:A4FB4EBD7E5DD00C3CDC86A0F11100623348E57218DC417D55F625FA0EDF144971E39B60A040684241F6F4FE13D68397AC8F47D251F677A1E3A51098A4235433
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xzq.xzq.xzq.q..lzq.q...zq.q...Ozq._...wzq.xzp..zq.q...fzq.f(.yzq.q..yzq.Richxzq.........PE..L....Y.Q.............................+.......0....@..........................0......@-....@.................................L........0..@............................2..................................@............0..<............................text...o........................... ..`.rdata..L....0......................@..@.data...@I.......,..................@....share....... ......................@....rsrc...@....0......................@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTQuickInstProxy.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95608
                                                                                                                                                                                                      Entropy (8bit):6.367483084267698
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:vLrdUPI24KL2zLaTRasZpLqCtQyZOUAkko5Rdj5IuwS5wCaD:vLrdUPI24KLbM0LAyZ1dj5Ic8D
                                                                                                                                                                                                      MD5:9C25145409A526C663D25822A2B8201A
                                                                                                                                                                                                      SHA1:4C22A4D2FF1450DC43503B161A44DC44499A4292
                                                                                                                                                                                                      SHA-256:5EBAAF4478F9ACA39BE440E687FAB7614C1CB51DAF679EE0B89FF40EB741B825
                                                                                                                                                                                                      SHA-512:78D6DE19AF8DF9862D0EDCE551334109A10F108D185596F8C36CC586F2CE9DC28D528888E153CC2D0F892A4B6D6A174BF693F2D39A1F7967ED440D54579EBA5C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..h...h...h......h.......h......h..J...h...i...h......h.......h.......h.Rich..h.........................PE..L....a<P.....................v......SY............@..................................?....@..................................+..P....................`..x........................................... ...@...............x............................text............................... ..`.rdata...3.......4..................@..@.data...`>...@..."..................@....rsrc................@..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DTShutdown.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):240304
                                                                                                                                                                                                      Entropy (8bit):6.486048784542187
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:pWmcumWKrd6V0v2QiDv3kGeeL75oe8D8lhSOXYox0n72FspCMX5CBaaaakcDCkqG:znalij3CHD8lhBotaF8CMchtqji
                                                                                                                                                                                                      MD5:6F712FAAF9EDF362136780C25455B1DB
                                                                                                                                                                                                      SHA1:1A968BC1596B0CDC1A4E795A2EA662848CF2331B
                                                                                                                                                                                                      SHA-256:9A693E0A675BFB8A4713B7822FFC608CF6BA2D4441252039C619FE345AD57E3F
                                                                                                                                                                                                      SHA-512:E5BF190D46219DCEE909CCD6EF46168268412BED4686B11AF06E211B56106158F7E57FC03572293E3BA7728DC55F3B3827836D091DF47589DC13C206451F6EC8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<@..]..]..]..%..]..%...]..%..]...C.]...U.]..]/.\..%..]..%..].....]..%..]..Rich.]..........PE..L......Q...........!................................................................i.....@......................... 8..h.... ..................................8(......................................@...............D............................text............................... ..`.rdata..............................@..@.data....A...@...$...*..............@....rsrc................N..............@..@.reloc...:.......<...T..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ImportFavHelper.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):716464
                                                                                                                                                                                                      Entropy (8bit):6.887338423237583
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:SXobqb7txh0BHw/dq70//Le71eBSlX4QwfgW3hFHOnNGzjuzG/SY0ekSkS2L:Wqe7oq014Sl/wV3/HONGfiG/US
                                                                                                                                                                                                      MD5:01E6C6FD97BF4F23D3CD5BE9E4BE53DB
                                                                                                                                                                                                      SHA1:F691E5EF40701BFEF9BD88FF50B46E2793772F8E
                                                                                                                                                                                                      SHA-256:7FD2A1A53E3EEB2CF446C611BCE1DE50E26B6E46680520FFCD0465D04D9514E6
                                                                                                                                                                                                      SHA-512:64C45D755EA64C9731A7D63E6AB5DE6ECAE6D55956B3EC0C0BABEA713C57E31139E4201974E6F2980703EA5B210D94BECDF04A54B647BB816480DB7A1192FDFA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.Va$.82$.82$.82...2%.82-..28.82:..2 .82-..2..82-..2k.82..U2%.82..C2;.82$.92z.82-..2..82:..2%.82-..2%.82Rich$.82........................PE..L.....ZQ.................$..........o`.......@....@..................................r....@..................................S.......@..|........................K...D..................................@............@..@............................text....".......$.................. ..`.rdata...%...@...&...(..............@..@.data...(....p...>...N..............@....rsrc...|....@......................@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\10\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):320
                                                                                                                                                                                                      Entropy (8bit):5.326804241243158
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xMxVLKOSrPjnFXirPZNbUQ5l3nZKARTKRo0Le8MqcsNJs:2VLViRCrbd5VnZK0TKRNSsNy
                                                                                                                                                                                                      MD5:54474DB3D028B1527B7259E6427F7DED
                                                                                                                                                                                                      SHA1:CCB8D4866FFD17CF518BEF9E18FDD441DFCBD4CC
                                                                                                                                                                                                      SHA-256:62A5F86D26164A133C033B8A09EF5137C73FB45A7EC4563EACD4B016C8351230
                                                                                                                                                                                                      SHA-512:FDCDE8E131D79EBC4E93F0F8BBD41709ED4C8CF79A8BDCFAB57B9067B7855498E0BE4E3044C0C4BF3BA4CE9A141B00CA5646E06B23EAE1EA760CC8463A7A7E87
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=10..version=1.0.0.1001..name=........*............[AppSetting]..icon=logo.png..smicon=logo.ico..frame=1..title=........*............url=http://static.apc.360.cn/cms/skin_uploadwebapp.html..catch_img=back.png..width=760..height=480..timeout=10..fullscreen=0..rclick=0..max=0..vscroll=0..slideeffect=0..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\10\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):9662
                                                                                                                                                                                                      Entropy (8bit):6.561898688748442
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:sUcTe6rqKLcgvdeqz+Ql96HAyHX3LpCEqqNjllgPxxXJitQp:LKIgvAsl9IAynzqOLg/ZyQp
                                                                                                                                                                                                      MD5:2CD835A7A37080E6407EECE713D94D85
                                                                                                                                                                                                      SHA1:0B3C0DD404B8283649E297577A07D061B1E027C2
                                                                                                                                                                                                      SHA-256:0573D5F151A829FE8795A1EFBE2B22CB50F70B52E674E628867F6C35578C1890
                                                                                                                                                                                                      SHA-512:53DB5DD3CBFB899C3B308C15BD0657E724D60B29533EECFD90704A8D8EA99BAD4A7F9F3FFDE2CAF9F119E3B53C80C5260A96FD214423AE31335B97EC11BCFE41
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%......(...0...`..... ......%.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................a122.0/0./10.132.132.475.<>>.JKK.TWW.]__.dhh.gij.aee.[\].QRR.FIH.;<;.465.344.376.585.698....Z....................................................................................................bcd.^``._`b.]a`.^bc.rss.............................................chf.bec.bgc.efe.ffe....w........................................................................................................................')+.........................................UTU....#....... ... ...'..............................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\10\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1018
                                                                                                                                                                                                      Entropy (8bit):7.745716050054846
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:GiTESGwxRqlt1m830H8v5DbpT53H/+kkz6iqR0:ZYSGwnqiH8lbpT53H2kNhG
                                                                                                                                                                                                      MD5:463682E0470747EA57EC16831288666E
                                                                                                                                                                                                      SHA1:E2FD1968489B79A5B63401AAD5D76C7ECE216D61
                                                                                                                                                                                                      SHA-256:073286DCD12BAB82FE98695C9BA2C477B1C3D693BBD269D49F1930E1D92F3F34
                                                                                                                                                                                                      SHA-512:A849D00B70AA8F8FB89D6E93F3E3AFC68996094EC450AE40DD19C643EBCC657FD14EE40B6548FEBA9F64FACDF43C0C10D36F17918FB1DE9589E9B41F4F6D1969
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.LQmlSe.~......u.vm7........9...H.1.E.Y.....]L4..'...C..?..%.,.".b`a1X...8$..c.]m{...{{.....'99'.9..9.]!?V.h.V)..]....J..x...Nr.6.Z..:...jU..0e.y...=.'.....O(..w.X.s.9.$Q.../.o..J.2l.....~..^\9SB..X......~.m.L...n.r.sD....'q..eX.....v.j...o.O=v...2,..~[..< z.8.9..*..=..!AAS[.....^..;?.....a\.K..<.........,....Ss.QS..2X...,.........8...7m.D..G$hS..%..............j..!.P#..-Bc*...C.M.'....."....;. [...I..s....y!.|.X.@..A..\)".0...W...p..;d..^d.f..5.]D..........g.kz..OO/....c...16..i.e+.r.J.4.+),]..3.....`.f3.~.iC.{'}o...E..A-"rZ.L...VM.{|....SJ.H..N.!...Jr...YY.j.D.....`......\.R"./.'.a3....J..N&h..,...#...........Z..@X..k...B4.AJ:....fE.U5.V.E.7@b.&..ws.7.f7PX....f..^o..m....Y.9##..X.C#.D0..[ g.=.{...NW...a....&7D.EV..s......!..@,.G4~.J&.Px.(N.<..L.........#{..[o.P...<`.w.. ...........B..y?l7|.....,.x...#G...`....8.+.{.y.b..R...P...=..ZW).N....Ee...o.........T.p...$.W...a.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\404.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):581
                                                                                                                                                                                                      Entropy (8bit):5.671194366055472
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:h4QW3tL6QcjWR0NNEXW0YWtRIkT4BkQiE4mT/qzRWh0M8pcPUvSsmNTAXaWmkoz9:hPg96QclfoxdGL8pccvSsmZ2bc16+AGb
                                                                                                                                                                                                      MD5:F14655D20C6A0F8F7689556EEDC6EC78
                                                                                                                                                                                                      SHA1:687EEA25A387F769FF4F276A44932373E0C18D21
                                                                                                                                                                                                      SHA-256:4BC05D51F81F548FEE56744D979AEB3782691F3172AFDBD7E9880A8C9AFF0551
                                                                                                                                                                                                      SHA-512:D4138FEE06B99C317B50EE13B4E921D17F84D357BA9EC595B352195156D4255E23A39A67D5FD59FBA75DABF59C9B54867522AA21C5CB5D6491AC0D7D0BA91D40
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta name="Keywords" content="......" />..<meta name="Description" content="......" />..<title>......</title>..<link href="style.css" rel="stylesheet" type="text/css">..</head>..<body>..<div class="bg404">...<p>............................</p>...<a href="#" onclick="window.external.wappCheckNet();" class="icon-1">........</a>...<a href="#" onclick="window.external.wappGoCurrentAppPath();" class="icon-2">.......</a>..</div> end bg404-->....</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):268
                                                                                                                                                                                                      Entropy (8bit):5.016387560591547
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x/XWVLAcVnT6NbUQ59KKY/JdstJUqW0JOLeRM3uV:JWVLAcN6bd59KKY/JutJQWsuV
                                                                                                                                                                                                      MD5:11153E7A49AC28AA0F6A5BC13B4155FF
                                                                                                                                                                                                      SHA1:4641F591FD8E31C8B00B231FA79B2700EC7A87CF
                                                                                                                                                                                                      SHA-256:3BC6D68B3423D29CB03D5CEC8E4FA2262D4A7DBAFC020A68520B8EA3A0E573BC
                                                                                                                                                                                                      SHA-512:14AC8011A89E86FEC6D24AA5DEF28AA616E49E6447C74E428A59D73BD894E7C36EAB9D2D89171E6C663D1536F6631B4431FCEA5791B2E3C7AF802A30893C2F1A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=12..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/selected.html..catch_img=back.jpg..width=780..height=508..frame=1..rclick=0..timeout=10..dialog=1..errorpage=404.html....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\img\bg404.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 779x480, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):14335
                                                                                                                                                                                                      Entropy (8bit):6.92934378343167
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:7UpzlnERXDNZSzCA8h+uSp5cbSfbHwjzVsZGq/Slh1XOQuytQZ4z:qh0XxZSzCt+v5ISbHov5OQM4z
                                                                                                                                                                                                      MD5:FAF8B6385FD7F996E95F05BD1F835895
                                                                                                                                                                                                      SHA1:DF57708B207CE7C482ACFE33898DF3CF12344B15
                                                                                                                                                                                                      SHA-256:611C3EBA62899A3A033CF9C0E120794E676EE574E161BB9CF35CFD02C47BCF96
                                                                                                                                                                                                      SHA-512:064F591A8DC156802867460D34D1B0B4887707227E83E5D693B1209911E18A205BA80DC6994DC876D217CD096935CE8C94790EFF0A068674B1D09186F105A3D9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......F.....)http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5684837B8A2111E1BE88852A1E825E74" xmpMM:DocumentID="xmp.did:5684837C8A2111E1BE88852A1E825E74"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:568483798A2111E1BE88852A1E825E74" stRef:documentID="xmp.did:5684837A8A2111E1BE88852A1E825E74"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\img\icon1.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 15 x 15, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1427
                                                                                                                                                                                                      Entropy (8bit):6.7017778396309815
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:e/1hpunQWwjx82lY2T32HEV/jdryJ3V/gKPcGc/drFnu9I63Wd7FTpt2STg9:eNitNn2VpZmJ3xgMc9dZnu99+pt2STg9
                                                                                                                                                                                                      MD5:3F70A66B5656E9B98EAB16B97AF4DCF1
                                                                                                                                                                                                      SHA1:FF8371FCE8A94F339A005E50EE56A94DBE6D34F3
                                                                                                                                                                                                      SHA-256:F554B18F74C318F1C83E0C83FB7C0EFDE426C96742FF4FCA788030FBDB690D32
                                                                                                                                                                                                      SHA-512:0963755D42F563463D182BA4342E632C0AB4F901ABBFF5AFBA528F4B11736CB745432850B2DAED4F649305E6203310ACE3A3B4F270440A3190393D6C80A780E7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............ex....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:85E7192B8A2111E19C57D1488CDA6081" xmpMM:DocumentID="xmp.did:85E7192C8A2111E19C57D1488CDA6081"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:85E719298A2111E19C57D1488CDA6081" stRef:documentID="xmp.did:85E7192A8A2111E19C57D1488CDA6081"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8.......PLTE...{{{................................zzz.........|||..................888.....///..................mmm555BB

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\img\icon2.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 15 x 16, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1341
                                                                                                                                                                                                      Entropy (8bit):6.660314282726688
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:D1hpunQWwjx82lY2T32HEVC4paKmFj8yJ3V+ZscKojGhL4zO/mnZ1D6I4Q:JitNn2VPpqFrJ3EZsiju4z+mnPmI4Q
                                                                                                                                                                                                      MD5:022049480A6EEA22446A57B2B48D6BC7
                                                                                                                                                                                                      SHA1:3385B067F1E663C28F777A96AE5957A7B574E9C5
                                                                                                                                                                                                      SHA-256:388A11AF4D1B8EDD9A3B4B0180A7FED9CF02B8F45385FCFFD4051C3D64CA146F
                                                                                                                                                                                                      SHA-512:81038C586AC241C120B00301B5DC744AFE90B059BD69600E90F140B3CB32693FEE68F312934262D3FAC3B4537E7B45D9D44520EEA3855DD674F30175AC9602CF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................6....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B4CBF35B8A2111E1BC3FAD68A8934BD7" xmpMM:DocumentID="xmp.did:B4CBF35C8A2111E1BC3FAD68A8934BD7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B4CBF3598A2111E1BC3FAD68A8934BD7" stRef:documentID="xmp.did:B4CBF35A8A2111E1BC3FAD68A8934BD7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...U....PLTE....................................aaa....................................................|||qqq@@@.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\img\star.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 71 x 30, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1460
                                                                                                                                                                                                      Entropy (8bit):6.710870562337673
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Uu1hpunQWwjx82lY2T32HEVL6oyJ3V8qGAHgHUu6BmiPDM1r+5Ckz:U0itNn2VwrJ3HnUt6BnPDe+5dz
                                                                                                                                                                                                      MD5:7094A805F02511F487BBB62E46730610
                                                                                                                                                                                                      SHA1:AD83885F1146A009925539715C2D944007990CF5
                                                                                                                                                                                                      SHA-256:2142EBCE84866039D63B991E0CAE2AE7A4DA7BB7A6696A9AA0C27970204F21E8
                                                                                                                                                                                                      SHA-512:A875C83E8FDDE33C1DF7310B4F840995C0FEFE493C4AEE42F462FF34C3A04A53F2134389CAAC2219C3F8FCAAE367F36DAE37D2D7403EC06D5D3CDC20B832A59D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...G.........I.......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D469F9978A0711E1A913CE9E06B5EE48" xmpMM:DocumentID="xmp.did:D469F9988A0711E1A913CE9E06B5EE48"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D469F9958A0711E1A913CE9E06B5EE48" stRef:documentID="xmp.did:D469F9968A0711E1A913CE9E06B5EE48"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...o....PLTE............xxx...uuu......}}}PPP........MMMzzz.....yt"{{{<3*..ooo..dddFFFJJJ...UUU~n"ttttd ___.....TTT.r

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):4.853209632444685
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:KDnYX6EGZ5XQV9WR6ZYL6GV5Er+QasB6l3Jrl2ABWgAtcYMEycxOwA4Au:KDnSdG0rWRB6GhUBIZRASYMQOlw
                                                                                                                                                                                                      MD5:77224A930D612CFA147269F5BBD2B2AE
                                                                                                                                                                                                      SHA1:4A199B46F400E43B8D92EB1347421486B7D2582E
                                                                                                                                                                                                      SHA-256:818BAE51AFDC6AB53F20962AC7333DE7ACA75B441D0C3D393E03E0B5E1DFF938
                                                                                                                                                                                                      SHA-512:C141B1F74C2F38B10A9B759BF21805E2E9AA925781599199F3F558C950EEEEAB1BDC13027524DD3C635044C7A6D005D848D835CF700C9ADBA1FD977721341297
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ........................................................................................................................................................................................................................!...;...K...H...:...)...........................................................................................................?...e...|.......p...Z...D...0... .............................................................k.;.k.i.k. ...................4..._.I2..^8..1.............y...l.6b..J...9i<.................................................k.}....&....u...k..g.K.......&...K......`...r...Q..k?..P6..)9..0U..Fq..\...U....8#.............................................l..W...Y...J...6....z...a...?sz..._%dQ.>...7..%....v...[..nC..ue.#cp.'[...Y...F.a.............................................l..b...l...M...F...C...2....^...=o.:...L..4..,..)..%.......f...S..rQ..hp..Kve.............................................m..b......._...D.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):773
                                                                                                                                                                                                      Entropy (8bit):7.695863552306289
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:37MFMYOphpgl8jMKuU7mTOSGvo6Ge8SU3ax:37YMXgDjQD8SLx
                                                                                                                                                                                                      MD5:C6D64D2E656C4B4BAB740F9B2E6BA71F
                                                                                                                                                                                                      SHA1:03930A6FC25F5509049DEBB5375CFFA29393057C
                                                                                                                                                                                                      SHA-256:6F4E916D0D8A96AFCE535FB2C72872CE85D4DAFFA230CFF432E64BD3FD92706E
                                                                                                                                                                                                      SHA-512:1523890264AAFA976A9214533B58697B88F807568B690023C32C4835828B28DF85EA397F2A529717C991341A74B89D917C6D89F8CA15E2BD0DEA98B05B493153
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMHTQ......S.F..tt....$EJ.Z$..D.h..p.").........m.Z."p..pQYi......4...y....)$..{..~.........l....J..V>.V........W...a.../..e...sc..S.66...............90w.e.{...o.Lj..r..k%4K.>.oW.!.K.....u..R........&..-f...@.fZ.y.!..+a..`.1XF.|L.l+8i.+..R..$B:.....!..=.._y..=..,/....E.`....#P...Z0....|z..O..E....E .,.:....^0*#...#._...T...*.'.o+.^....wW...PN.2..4 A...d2...l....q\.<.C(..4..\..N}g..{*v.J..=.S...h>..'Z....R...#.....Wml..X'..........^.ee!.d./......rQI..Zg.....J..].K...]&A]Fd..1-...u...:Nz. q.j..T..@.:..}...|....gmm.....6..mc..F...@Q]$.d0?3......U>......o..}...a:..."[Al..V..G.:DX|.|.W..L.y.ISYB./Rl.s...w.r.p.m ..m.i3]...W).1ddH....0.<.&..mV!....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\12\style.css

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2834
                                                                                                                                                                                                      Entropy (8bit):5.217757716871249
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:hAyEm4LVV2K+cxaxVvZt67x3aYM+j6AK5:hzETL72+wvZYx37Ms6A0
                                                                                                                                                                                                      MD5:DF8ACFDCBAAC70E85A66F54AD5A7CD28
                                                                                                                                                                                                      SHA1:48A82D1BAEA5458F328AA5FA91FA130DEC38B86B
                                                                                                                                                                                                      SHA-256:DC8C5BBF0CE53259F05D78EED3C7E389C78ED8F35EAE8184F5364824375DACBD
                                                                                                                                                                                                      SHA-512:686B80F9D58EBE22CC7C1C6FDAFB1BD7976B9BED194E9D184844DBA3D42A9B94195DB8EBA6D49828A97368F12461637866C2E7734AE10BD82B7313860FDA121C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:/*Reset*/..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0;}..body,button,input,textarea{font:14px/1.5 Tahoma,Helvetica,Arial,'......',sans-serif;}..ol,ul{list-style:none;}..h1,h2,h3,h4,h5,h6{font-size:100%;}..fieldset,img{border:0;vertical-align:top;}..table{border-collapse:collapse;border-spacing:0;}..address,caption,cite,code,dfn,em,th,var{font-weight:normal;font-style:normal;}..a{text-decoration:none;cursor:pointer;color:#fff;outline:none;}..a:hover{text-decoration:none;color:#fff;}..body{color:#fff;background:#2e2e2e;}...wrap,.bg404{ width:780px; height:481px; background:url(img/bg.jpg) no-repeat; margin:0 auto;}../*cover*/...cover{ float:left; width:310px; height:437px; overflow:hidden; margin:27px 0 0 18px; position:relative; display:inline;}...cover p{ padding:0 15px; height:82px; background:url(img/txtbg.png) no-repeat; position:absolute; bottom:0; left:0; _bottom:-1px; _background:#000; _filter:alpha(opacit

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\13\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):276
                                                                                                                                                                                                      Entropy (8bit):5.042940971137794
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xfmVLzGtZVnLJsNbUQ5TkHJKKY/HXVgXhXW0JOLe/sK:kVLStZVubd5TzKY/6XgWuK
                                                                                                                                                                                                      MD5:76BCFEB0BFB8B6BD8CEC28854FC4D42B
                                                                                                                                                                                                      SHA1:76AFA2BBA001887D10839624142FECFE61CEAB4D
                                                                                                                                                                                                      SHA-256:459231F45A31166C2E5B623A28B6D2AF95385ADFDE2E8B273FABC7BC9DDB442F
                                                                                                                                                                                                      SHA-512:60ABB38C8C3319DECD8C1742AD2501584B24479761A4F88FD6454300677B3DB5D601D03D8699F2689B662D1159AAFB5C5D4A6FEC4ADCD384FF7FCEE7C981742B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=102395759..version=1.0.0.1006..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/video/shipinhezi1.html..catch_img=back.jpg..width=920..height=700..frame=1..rclick=0..timeout=10..dialog=1..max=0..vscroll=0..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\13\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):5.282838979968636
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:T4a8bQsPGZYKQ36wejgyzSy+oYV+DMxZC5e1aaK6Ath2BcRy:TX80sP9Yl+/VlDcet6h2Ww
                                                                                                                                                                                                      MD5:C01D51842DAEE8580974E01879B235E3
                                                                                                                                                                                                      SHA1:70FBF395BE53B5AC089CE4D9EC253F49046EEA12
                                                                                                                                                                                                      SHA-256:7B062943DA7C2D5C5E327E280174AF39832FFB9C0DFDA4B54567980CD8E42663
                                                                                                                                                                                                      SHA-512:B5CC629A8F96F35DBEDC7A1DFC6AAFF743C739F395F294A1311F19E7C01CCB5EEE557DC5DE2C5C58B518F86479754E8A4A5034A6FEB2DCC69B306F2051454002
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ................................iLLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL....T........LLL.VVV.ZZZ.\\\.___.baa.edd.hgg.kjj.nmm.qpp.tss.vuu.xww.zyy.{zz.|{{.|{{.{zz.yxx.wvv.trr.poo.lkk.hgg.dcc.`__.\[[.VUU.LLL.........LLL.XXX.vvv.xxx.zzz.|{{.~~~.........................................................................~}}.{zz.xww.YXX.LLL.........LLL.XXX.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...O....v...r..=..V...Q...O...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...O

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\13\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):440
                                                                                                                                                                                                      Entropy (8bit):7.086005302182458
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72PGibjgYpQXmngdL75VfLfT+bmhPtN:qsv5gR5VfTk4z
                                                                                                                                                                                                      MD5:B9092CE8A3E15D256B74F3D613FDC3A3
                                                                                                                                                                                                      SHA1:AED3236B71F433E2711401DA6BE0DEB71BCE388A
                                                                                                                                                                                                      SHA-256:53690FBF4331D52E27306439966B46A592EFAA673E51A4F230A40C6385F1BCB8
                                                                                                                                                                                                      SHA-512:05D1BF69CC149906706298FD4486FAD200451D32D37005FA9437328423FAFC9BE42A520B978250F0D241F900B4E3EDEC1B55456C553513F5C61CF5EF5832876B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b...f...._.2.....DDD.122...I.....A.0.y.FK[[.a...(&.0>..'.........G......M.+....+..G..QQQ '1...0|.......D......U...@.aaa.....u.........w.^......L..l.@.......4>.....Y.........$G!.77.%.,0....(...2L\.......^...L..dbD..2......j2T..E.Q..........7...3L..a...@.#......+....0|....<N....>c.C......n...j..-...2..L...(. #3...>(/P.....xk.f..#.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\14\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 800 x 600, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):42976
                                                                                                                                                                                                      Entropy (8bit):7.976986096657465
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:JY8DOTs0tZu86QOBlrpSYZFOS7TW1jzoouQQObUTQHd9W:JnaI0tY86QOBhpqgyX9uQQO8id9W
                                                                                                                                                                                                      MD5:44F6139324A0D5BE1FEFC6AF9CFF9BF3
                                                                                                                                                                                                      SHA1:F564C49D243B598B6230F823E894A22C99AC6E30
                                                                                                                                                                                                      SHA-256:401FD43380FB9AE94E5E3D0C7C3FA5F663952AE1FFBA9F01EB019922B1EA9794
                                                                                                                                                                                                      SHA-512:AA302CA47AD77CCB566A57B19DE784FEFDA0241D36986CEBD19850F170ED7B1B8DEAF18D57ABE9FBBB8F871C5F1EC36C0BC96DA6249A95397E4A893EAA97E82F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR... ...X........'....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Y.%.u&V....nt7z#6B$@6(...H...5.=...F.....c".`{.:.~..!..m.~....$...o.....8#*$....!)......l. ......o...T....Yu.O.V....2O...2.,t...?v....A.P.UPw....{...(.!..j.]...Zd......e..Bgh..]...#V=.Pd<D.y....._..(;Z.(.f....-.M.GJT..U..p{.p.p...%........."..&{'.....6.....B............0...S*h;(8..w..V.c....,..N..]c.......b......Z.E.>@...L.ou..2..T.[W.jg..`a:....A'.....o{.'.P.;...c..=&.k-..zk^... X@#sG.>..F...tK.<]S;.@...ddu..1.. c...z..u..>.o.....5O.......U`.].0dn.7.....$../...f..0k....wB.o.`.,.%4.(.....fE&e..e.i.1.......].....B....N....z...<....+..K.HE+5...D.V...s.7@..i.TW.Y.#.......f......@......In....n.A...w.s..M.Q.~.kx..nr._..b;...V.v..)"_8n....V..h{.p}!.`.F...S.ik.Hn.7_T\.5M4..=.g....N...1..xb.l.W`.....T...[.tX.......tB!W.. X+.g....V.,z/Y..2.aUZ....*..eb.a.t..4._.p.}.V.d.i..+yq......m...ZU+o...._..L......lgm.v........t..L...mh.}......o*o..T.:l3... .(...E..:.?d......B...6..f..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\14\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):257
                                                                                                                                                                                                      Entropy (8bit):5.037816982032033
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xkouWVLVS1VnTkNNbUQ5WKCW5MKAX8VXW0JOLe8:iodVLVS1JQbd5zMK88UWG
                                                                                                                                                                                                      MD5:1AC97EB96E408FCA59220829D5F359DD
                                                                                                                                                                                                      SHA1:58839DE61AA3112519C29E69CEE87AD73D53555F
                                                                                                                                                                                                      SHA-256:A6A1580CA87A12E35774A2FA67A9DFCD6EDF905E7512C55D591EA10E66DC52DE
                                                                                                                                                                                                      SHA-512:D06127BCAB88EF19ED0C686219AF684AC552462661E399815E4E2863A1E74A5F2F3F695967EBA8F1B62409620937347AA7AB92EE67578F6AEF2C74326BB69882
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=102395754..version=1.0.0.1004..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/music/tingyinyue.html..catch_img=back.png..width=800..height=600..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\14\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):3.2550150789181798
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:kOsvGVoyywlkyy+PNkFl34XCXBq2kRMbZ1IIIIIIIIIIIID76rNU:kOKGVPPu54XCR8cGU
                                                                                                                                                                                                      MD5:77F7A0EC343EB8863C600A7DF658C29A
                                                                                                                                                                                                      SHA1:622E65827F7E0B1549811F884D0A5515D63B83F6
                                                                                                                                                                                                      SHA-256:B330B7064CD9A60146C6C18048A26E14642B4143E50F8173DFA0BFBB55628509
                                                                                                                                                                                                      SHA-512:3B41E06C47329D386C7CC959BD84166D619B16C91D2939615C5C3E43BF26B7DB3759B9DA7E0539DFE5D48FA08C745A62F40A2C19F8370FE1D266A51DA1195F7F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................................................................1.H.}7...@. .M...@..}7..1.H.................................................................................................}8. .N. .N. .N. .N. .N. .N. .N...:......................................P$u..?. .N. .N...?..P$u.............................e.. .O. .O. .O. .O. .O. .O. .O. .O. .O..j0...............................@. .O. .O. .O. .O. .O. .O...@...........................H.#.V.$.\.%.^.$.\.#.V.!.O.!.O.!.O.!.O...J..........................t3.!.O.!.O.!.O.!.O.!.O.!.O.!.O.!.O..l0..................... .R.'.g.).q.*.u.).q.'.g.$.Z.!.P.!.P.!.P.!.P.........................!.R.$.].%._.$.].#.W.!.P.!.P.!.P.!.P...J......................t=.+.z./..1../..+.z.'.h.#.W.!.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\14\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                      Entropy (8bit):7.410199232361714
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72QMpFzl013hVoss5uA8IFvxYU1I6FHrtoGAWh3:kMpFmGsm8IEUC6NtDh3
                                                                                                                                                                                                      MD5:9832AD31BB85BB3F6ED4A91F1758C968
                                                                                                                                                                                                      SHA1:5A78759E3A544619A60FF123450D7ECEB7ED9A12
                                                                                                                                                                                                      SHA-256:F64147F2D5DAE7DFB98776F24C45D4021329B6C264AE7308845C9F5DFC2631A0
                                                                                                                                                                                                      SHA-512:500659B62217099F29639D68BA391B51AFA62B216326E5E17BFE7C612AA62C964C2DB4A312507411087E9A16372469965C256BCE5F2D20B093E4AF376E006228
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.S;K.A......`....m..(..ZX....m,m........A.....&.H@%j ..<..s...u.pr&..t.c.....%B..........._.........@.T.Q..X<.]..<f*g(.V...+@%"{e*K...2........n..%f.m(P1...t.`...!............_.4..9.X..G0....h...z..\N.....o...T:h..u.......M....m;h2...mg..+...6.l....8.....U......Ay9U2.....=..."......g.tD:^}eT/...{.1 ..&.}a.{.S`.~TI...!..`_$.SY..].......&.........C.<....^{..;5M.Jf.C.o#..s...&_.[p...?......../W..V....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000094\Loading.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2012:09:26 14:27:43], progressive, precision 8, 717x671, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):16051
                                                                                                                                                                                                      Entropy (8bit):6.383750878137176
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:Vncibwy4Mjk8cirkn6JrYNMtKwrwLZS37ONYxdYmz1f2/TF51:VfH3/An6JrYNg7O4L1xdHix51
                                                                                                                                                                                                      MD5:EA53BE66F4F8D34176779A2DECB17306
                                                                                                                                                                                                      SHA1:AA20C6B8B45919CA45E9149A2787A46C2F4B1BD3
                                                                                                                                                                                                      SHA-256:FA2BA962CB670DA5ECD43312311C21BC493311B923468A214705DFAD4349F1AB
                                                                                                                                                                                                      SHA-512:5AB92127797CB510148C10E2B87A104C803806CE7CF7F683B0CD2F1450DDE4120471E8861C3272B701031E1B9961654FEE4B43E1B85F7B99FB00EAFC60D7BD9D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.....`Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2012:09:26 14:27:43...................................................................................&.(.................................*.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.O.B4.Y$.%J..I$...I%)$.IJI$.S....I$...I%)$.IJR.0S

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000094\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):310
                                                                                                                                                                                                      Entropy (8bit):5.107261797814054
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x82RcVLwSSVnGSDNNbUQ5joLD/MKpjJJLkn5LwvNzALwvW0LWERSyBStp:u2cVLwSSsSzbd5ULDEKp1Jk5UAbCSp
                                                                                                                                                                                                      MD5:792BE06C777E7289AA7743B3578EDFD8
                                                                                                                                                                                                      SHA1:102EB6C07CA71042345FC0E887F0DE1E59F293CE
                                                                                                                                                                                                      SHA-256:012199A9362834D304C490A4B87D306064994B45ED569DC904FA9719E96CDA57
                                                                                                                                                                                                      SHA-512:60A0E7538168CD5243CB16ADFB11D84949B3621C27D91F6548EB0E34A77C66A4DD5149521FE52201295BEACE09954D72526279D033508A34EF2509DE6FCB3CFE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=40000094..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/theme/index.html..catch_img=Loading.jpg..width=717..height=671..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..hide_share=1..dialog=1..NewWindowInIE=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000094\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5430
                                                                                                                                                                                                      Entropy (8bit):5.1820953247333605
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:MHUxOezcKDm7oTao7H5I/prMC+B9jmvn0SLBl+Qg4:qHkcKDP5kpot/jS0Us4
                                                                                                                                                                                                      MD5:447FEEE2F8BDA18A8FF699841D0B73D5
                                                                                                                                                                                                      SHA1:385C69F412FCC9F3A6979D4B0BC786C51B1C15C9
                                                                                                                                                                                                      SHA-256:9A0BBAB5E672AC9365F56BDF5C0FA4FAF69DCF80D08F0A7C8B622A72FA7540A2
                                                                                                                                                                                                      SHA-512:F4D6261CF727DEFF62D861053C6C8AA0D17283A0224D86859A325FDEDE36E3C1182FC4BC0B6504CBCD6027DE370A66EB156D4F2756E53D68D60C0BBE134A7C28
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:............ .h...&... .... .........(....... ..... ......................................................................................................{..XGV.R@O.N<L.L=K.^Ai.b=~.Y7..M5t.E6^.........................s=o.C0B.Q9P..\...l...N...;..h1..W1..E3...........................i.........|...e...K...=..~3..U1..SC...........................o..^..a..r...W...L...;...*...3..l^..............................X..E..?..h..\...:...+...'...y.............................k.N...D..C...F..A..kl..,...&.............................s..m....M...@...F..D..<..nE..)........~...P........j..................y....N..F..@...0..c=..(...#... .....8....M.3..............................N..8..r&..OP...........~...W..S.c.".8.[.....*...8...A...>...M......._....q:..6r..&....~......}..Z.n./.d.,.Y...U...a...b...I...i...w....~E..R..R.....8...........-....O...Q.f.g.Q]j.Jk..Jl............{...............................u{...4F=.p.z.....QaY.V.........:......................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000094\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3577
                                                                                                                                                                                                      Entropy (8bit):7.896644078371665
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/xYEIm73V60+:bSHIIHUCD4waL73V/+
                                                                                                                                                                                                      MD5:B12E3D6ACEBED86F40DFB4C894D24138
                                                                                                                                                                                                      SHA1:2768BCCD2F8ECF62BCD166CDEA53D5105B927C63
                                                                                                                                                                                                      SHA-256:72BD130D287CA9BC222BF22006CA9C7776838A664A3B8EAD5B061A6461F5C06A
                                                                                                                                                                                                      SHA-512:43506981ECB1ED3C3AD2C280777079E93EB7719F8A4A74688E2FCCB171850B9F2C31E218644E6C43A59A1A70C2F47B3490ED0EA0635D35975A6EFB9101AFCCBE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000096\back.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000096\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000096\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):622
                                                                                                                                                                                                      Entropy (8bit):7.566184431026209
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72r1s52jrOZBaFZgFnx5fCBOkOKtlZcT14kdqwJ7eNKyWZvsYSXmOT:31fuZMFZsx0BL3cqsnyWZvs/7T
                                                                                                                                                                                                      MD5:56AEE1C86D6256F465815579E5AD516D
                                                                                                                                                                                                      SHA1:6CF2FF2084E5695440F4C73A027545C2DE2CB533
                                                                                                                                                                                                      SHA-256:45AB4386467F1C6C692138C7352767F45AB341BA985CE0BAE3B685F0350E53AF
                                                                                                                                                                                                      SHA-512:BD304991D7EBAD9181ACD2C84FB32618E7BE35A69F1CF94289D2257F191917B6F43C9E68754E9D2102F31E86D380FDF4E58B29046EE543941F7BBEFAE35B7EE3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[o.0......nTm..RW.(H..T.....<...PT.^..V....ffr.E.,9J....7...r..@.?.s..s..hMS./#7....W<.na.F.F.....U.0...D....A...j.i.......dWk-..rl.~ .$..1]E'.&...']...z..x;?......Il..m..0.......e.-89ONLHpv<...}C...b!,,....i.8....f.....~......B..+zHy..o....#...x.X...y.....).'"....j....=.....N.~.<R...A...O..4T.(..F..Z.G.._s,.V.C........;......6...0e..9fG.l...F....F....w.....ShX.C*.....W.s...=/PQ..Kk.4Mq:5.ay... .6c..m..S.E*".M..`.!..^.O....= Nf..>..?'...{....8.....I..,H...r..$.......:...r.+.....eg...C.L..\.K....J6........IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000097\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):258
                                                                                                                                                                                                      Entropy (8bit):4.932198833574818
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x82xVLBHVnza/MKpjUeTVetLKwvNzALwvW0LWgvJv:u6VLdYEKpYeTstLLAbW
                                                                                                                                                                                                      MD5:CACD252CC23EC905A63DD8DC315219DE
                                                                                                                                                                                                      SHA1:34550B2838A26B8EA7301A5D1BDBEB9A16EC2782
                                                                                                                                                                                                      SHA-256:2FBAB88911F57D850191D2D76D612B41FFF7233026BB2AB96FC9A1AC0177A66D
                                                                                                                                                                                                      SHA-512:12F309EC5333628583516DCF0F57C871A3DB8175F7C4F84A23488060B776BD75BBB6E6E6AC4D8516106BDA02F013A046474B38F7C6A9FD6CAF352771B39D60F4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=40000097..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=index.html..catch_img=Loading.png..width=360..height=207..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..dialog=1..checkurl=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000097\index.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):861
                                                                                                                                                                                                      Entropy (8bit):5.4660632914667096
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPO9kQDbu7SGOL8orwtzzrdgCN0/oa3GCK6TqSByA+iY/PQEfjxvnfjL07THT8:hP8Z2jOwJtzP7ittHTdeiY/hfjNfjET8
                                                                                                                                                                                                      MD5:D94F9DFD6BE72C13357CD4312E29CF2A
                                                                                                                                                                                                      SHA1:E72A49B866693FF8F779161149D61424EDFFA85A
                                                                                                                                                                                                      SHA-256:2FF30F56322FA11D365FF77998E7B3982E5869BCB7B01254828C8814DDBECA55
                                                                                                                                                                                                      SHA-512:D4D76B4A49CCB21AFAE413FE07214F7CA2CAFCFB9929A27FF5E0260C14E80FE08C31FE6150B57D5FFAEA5C62461AAFA7B48B90FD0CAFBCD05385446F861BEC2A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html dir="ltr" lang="zh-CN">..<head>..<meta charset="UTF-8" />..<title>....</title>..<link rel="stylesheet" href="http://s0.qhimg.com/st.360.cn/;bk_up;style/7e995a0e.css" />..<meta name="description" content="" />..</head>..<body>..<div id="doc">...<div id="bd">....<table width="100%">.....<tr>......<td height="107"><p>"<script>document.write(external.wappGetSystemInfo("updatetitle"));</script>" ..............</p></td>.....</tr>....</table>...</div>...<div id="ft">....<div class="progress">.....<div class="val" style="width:60%;"></div>....</div>....<div class="btns">.....<ul class="clearfix">......<li class="s0"><a href="#" onclick="window.external.wappAppUpdate(1)"></a></li>......<li class="s1"><a href="#" onclick="window.external.wappAppUpdate(2)"></a></li>.....</ul>....</div>...</div>..</div>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000097\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000097\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):850
                                                                                                                                                                                                      Entropy (8bit):7.609811882129263
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:n0gD0BgZzVm/Wuf/c7CqKYPpVZ5jewEAQ26Nozw9:nfm/kChuHn16qk9
                                                                                                                                                                                                      MD5:0F4BA1A40C2EA13A402470EB81C8C59D
                                                                                                                                                                                                      SHA1:CCCE59BC5713AE2859611EFD1D030059CA09F3F8
                                                                                                                                                                                                      SHA-256:B1307EA4979EB106609D48A429641E9AD125BA8B7F8DCF2E46815DF3F83E2364
                                                                                                                                                                                                      SHA-512:0EF7CD9B7CEDFF638BD02BFB07FD7AF133D23E32CDD42693FCE5968AAA23C81D35BD0B46949DA562B166D3C152F5E8E4117326785CDD7C851E5D9A84A787866B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tIME.....+.Q.?.....tEXtSoftware.GLDPNG ver 3.4q.......tpNGGLD3....J.).....gAMA......a.....IDATx...{HSq....cZ...X..cj.....V.. ..P.J.%0....J.L.a.D..f(..9..AR..)...;.,.nS.......\~...Kd?W..~6u".`.hn.(..p$.......T.Dw.....#.A...}.'C|.E{..01..4..*P..95s....x..\..?....$I9.<.~.7.C.&....kb3.1.........~.....C...|(.]i;..:...k.5.$..k$!.q@...0o-.....O...Y..{=.,.rj.../-.g...m.T<@t...*8...3....gx=.1-.k..5.zP..+RGQ...B....x..p..p#.!...@.jcM_`..vn.*..$...@........e...C.{..._.`~.K.7L.@tW(.....m.....E.,.....T.....@.g.c...&.A..Cl..R.-.T.<....X...-y...C....i....".'.......:2.W.<.;f`.%..._.?M.`......a.....ks.:7@.f..6.X.K.0...30..c..&L....J1.z..6....0.].J...n..H..x<...c....4...$.5g....y".p..:.....Y.......+..X.n.Zg+L...P..R....0*.&.q..;`..._....d...Z.:9...%X,....6...?.Lo....\N..3M.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000098\back.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000098\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):620
                                                                                                                                                                                                      Entropy (8bit):3.72647716480673
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:Q+i/avYu/LwDeGti8PTpKAAtpKD9v4Avr+HKvmQSHQB5HlblYZl6Ya8DoDvZhSaK:Q+JvYu/LGeGZdKAAbKD9vNqKvmm5jYe4
                                                                                                                                                                                                      MD5:5E8605184EA5C11692EA7C7BADCC9605
                                                                                                                                                                                                      SHA1:97C4A0F2E615896AEC01A8B639FFF7D19D3E2E4C
                                                                                                                                                                                                      SHA-256:0B50ABD35242ED5AC75BAF159BBF4E3273BFA9B8F9B33E5DDD0CDC13DFB119A2
                                                                                                                                                                                                      SHA-512:A979EA89016B61E31787C476FA1C9998CAE4E87BD6976371666145DF822A75EC11E8AB42C15CC39BE772280D6FBB4C7B525E8543A75F68E984C3F1D5395171C3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.8.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.3.6.0..[hQLhb..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=..N.e.f.^..R....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.6.3.0.....h.e.i.g.h.t.=.4.8.6.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000098\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 16x16, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):6.631924571015197
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:jSnZcun+bvWCQ0NSxZdWoGtvH7/lF9PjZgBr3DPmRkLT4z:uZX+bk9WoUflNEr3zmRu+
                                                                                                                                                                                                      MD5:2A5907C09D75152D099621F1D40D7A04
                                                                                                                                                                                                      SHA1:779D93041CD0DBED5DEA3E4B4D315081FEAF586F
                                                                                                                                                                                                      SHA-256:ED874B0C638C1B4517A5E9EE21EFDD75DDD0F33CD6B2458F49C42333237778F8
                                                                                                                                                                                                      SHA-512:017B60B926D0B6AFB85C18EE2EDE125064754BFFB4E8A4A0460FEF88913DE3FD78F40E80CFDAC993F1AF8A945E8C35A71BFB426862E94BB278BC9D437AF87769
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6......... .h....%.. .... .....F*..(...0...`..... ......%................................F0..F...H..I..L..N..N..R..T..U..X..Z..\.._..a..c..e..g..h..h..g..g..g..h..f..e..c..b.._..\..Z..V..T..S..P..N..L..I..H..G..F...F0......................Eg..F..I...K...K...L...M...M...O...P...R...U...W...Y...Z...\...]...`...b...a...a...b...b...b...`...`..._...]...\...Y...W...V...S...Q...P...N...M...L...J...J...I...I...G..Gh..............Gh..G...J...L...L...M...M...O...O...P...Q...Q...T...V...W...X...Y...Z...\...\...]...^...^...^...^...\...\...[...Z...Y...X...V...U...T...R...Q...P...N...N...N...M...M...L...K...J...Hh......H-..H..K...L...N...N...O...P...Q...R...T...T...U...V...W...X...Y...Y...Z...Z...Y...W...Y...Y...X...X...X...W...Y...Z...Y...Y...W...V...V...U...U...T...S...Q...P...P...O...N...M...M...J..J...I...K...N...P...P...Q...T...U..!V..!W.. W.."Z.."Z.."Z..#\.."[..!\..![...Y.. Z..$e..'i..(g..)k..)k..)k..&l..%i..!`...Y.. Z..![.."[.."Z..#

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\40000098\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1791
                                                                                                                                                                                                      Entropy (8bit):7.282304314952082
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:QWHNn2qJXfIJ3JVJUkijyl8B5/UTvLoV5Gm:lt2GPsVJUk7M/vGm
                                                                                                                                                                                                      MD5:0C20581BF63BBD796E3D0B4B21BA9C76
                                                                                                                                                                                                      SHA1:8AE895DEE318A5F13D0647C289DD92DAB97010DE
                                                                                                                                                                                                      SHA-256:7782439597273E15F56453C0E20AA444F94E10845EECA9F5185ACDD5E03CCD22
                                                                                                                                                                                                      SHA-512:FC5D085F45B9D028614CB072C9C0D8AF6D7F25881CA79699927604F2CA7FB701AF9A671797EEE63115302B53D47014BF393BB127A79239162A8F607EC0D99C8C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7877C08B225511E2811BAB4F0B0366DE" xmpMM:DocumentID="xmp.did:7877C08C225511E2811BAB4F0B0366DE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7877C089225511E2811BAB4F0B0366DE" stRef:documentID="xmp.did:7877C08A225511E2811BAB4F0B0366DE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.`X....}IDATx...Kh\U.....{g.Lf:yL..6.I5.....E"]....T.W.V.A.Eu..#X\....Bh.h.VP...6)I.XC.4...$.d.7s..}zz.p.8....O.l03.h.JuD#Z.(

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41000017\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):263
                                                                                                                                                                                                      Entropy (8bit):5.059450475202175
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xrmVLl9ySVnFyDNNbUQ5/UyRZRMKY/JXmBgRXW0JOLe8:1mVLl0Sezbd5syRZ+KY/JXmVWG
                                                                                                                                                                                                      MD5:7F9B5752950F1B4FBE18F1D413078179
                                                                                                                                                                                                      SHA1:E2ADF90F718E886C0C46B0DADA852351E494D82B
                                                                                                                                                                                                      SHA-256:29A569803B2DFC63B96D0177E4824BFDED2EA9B176E779D47C3ECACAE35323F8
                                                                                                                                                                                                      SHA-512:A3E7F55CB9544F2CFB86F68402FDFDB10A2BDBEB323ABD1DE83E7D2B5FAC12380CD5B276FFF6A2E66FC131D7F811EA01B42E0141643DCC5A0B027DBD0DA22684
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41000017..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/ertong/ertongleyuan.html..catch_img=back.jpg..width=724..height=512..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41000017\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):5.272865555733899
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:YiWvOO6OOOOOOVdMHgggggeIK333P33333333wHHHH8HHHHHHHHB+cDXfchshfcS:vcOO6OOOOOOLMHgggggeIK333P33333P
                                                                                                                                                                                                      MD5:FA4C0871F09256E78A8572E0465BC1ED
                                                                                                                                                                                                      SHA1:FC79A4B2F9CDD30F34859B8008E9C00AC25BC7B2
                                                                                                                                                                                                      SHA-256:34C607A83BB9E1A3B152DB6C8ABDF5B6495032FC18B6EFF35EE1C435CE756591
                                                                                                                                                                                                      SHA-512:EAF558A1CDA73C57A3E546BEA105A08B4ED7D7B035DF8C2A089023973C0338B2B49E4B722C0B7FE93A42954F93220E59C754858956282724ADEEC1576153056D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................y .l..j..j..j..j..l..n..r..v...y...z...z...z...z..v..r..p..m..j..j..j..j..i...r..iC..........................C..A..B..B..B..B..B..D..F..M..O..N..N..N..N..N..H..E..B..B..B..B..B..B..;...\.........................[...W...X...X...X...X...X...X...X..._...\...X...X...X...[...c...X...X...X...X...X...X...X...X...X...z...........................>...'...)...)...)...(...(...(...(...........}...M...z...........(...(...(...(...(...(...(...(...(...f...........................F.../...0...1...1...1...1...1...1....@.....b.....d..z...&.1...1...1...1...1...1...1...1...1...l...........................C.......1...0...1.../.../.../.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41000017\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):616
                                                                                                                                                                                                      Entropy (8bit):7.530477633466423
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/72rokRmxkKU4RWmbiGIL9HXQFqsPxMRQhK9aebj8idjW:3okMkgqv2m/bhjW
                                                                                                                                                                                                      MD5:5CED58E294927112F3AFCAB5B3F65B84
                                                                                                                                                                                                      SHA1:EE8C0D989018997F7E7E8A3C8275A2C65DC9CF70
                                                                                                                                                                                                      SHA-256:E92FCB0FF36E4B879719DC86C041A0976C8233214CAA87A3C9523580D6F163FE
                                                                                                                                                                                                      SHA-512:76BE2FAC5893C5F04F70032CA7C82EBCD7207291D34D68243FCE752D9039587F97E27D16BF7E43C9DBD9384EED18BEDD514D054FA85077F06D10152BA076DAE6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMLSA......`.6.*.#....HB=..I9....r..s....$..../..C..W!.J.R.1........U1...By..;.{.%..F;.dfgg..fv.....C..~......._...S...4R.3..s.Z`.._p..p.b=k~...j..v3.2.|.}5.q .W1...3......,..as..........=k....^...e....&+i.A..i..".k..4Q&......~...5.....2Pu..#*{....D..Q$...*...e..U..l......;...P8H..T..2 ..a.X.#....d`...bL.I.Sr=.I(,.....(e......Z...pAn4v.V.....;.U......4..N#.e+.....)x.g......].8I.X..-c....Od4......k.....V.#. T.B0..H.)B.@*...umO:...v}.....f...p...........a).FU...\...ln....U..P>|<H.+y..o...y..}...K....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010001\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010001\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):317
                                                                                                                                                                                                      Entropy (8bit):4.935266667855842
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xEVVLhraVngYtrpNbUQ5nrD0oMKAX8VXzALysqcs57Jwyn:4VLhW+03bd5mK88FA7srt
                                                                                                                                                                                                      MD5:FB13058ECC9F1005547A1C11DF46628A
                                                                                                                                                                                                      SHA1:68B173CE3001210495879BB466DF942100C638F3
                                                                                                                                                                                                      SHA-256:0EE7BA429BC05BAE10A5B86410215361A9A191939DDD8094E85B2CE6D72A88B8
                                                                                                                                                                                                      SHA-512:23AEBF934F36FF1A3297FBE4D306F2C35FC1E6CA4884142E5B8E37A5801B0750A79FE8B9E01992FF5FAE19A6390E170595F12A194D669372824B6E4D448485BB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010001..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/social.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010001\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.1467555087668435
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/aKppe79frIPm+ZqhcTxFFFhp05qnU684m1eyPxakpDJnyC:icqfrICcT7U684msKakjH
                                                                                                                                                                                                      MD5:A4934622B853F2D0558B8810E0C24446
                                                                                                                                                                                                      SHA1:42662FC3F946988969854932471C79381C5E57AD
                                                                                                                                                                                                      SHA-256:B993933B9225C5476FA687F8F4A1D08465F3D198C36B761B10B76F58CE0E4FAD
                                                                                                                                                                                                      SHA-512:C5D1724DDEA8BE0882DD55B0E1FA61EE8DFE10A65CB838D2888156F9DAE6F2DDF7D6C58A6A3B4C0C337D86B1E7A9CE1483C32FEE6F7EDAC9D34554C431166C0A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................be^5hn_\io`Xio`Yjq`Xkr`XGo`XCoaX.haY.haY.iaX.jaY.kaY.laY.laY.j`Y.iaY.n`Y.e`Y.W`X.]`X.X`X.I_X.X`X.l`Y.L_X.:^..........................:...:...;...8...9..'@..+F..5N..;T..@Z..B_..Ca..Cb..Cb..B_..@\..:R..6M..2H..0C..*9..'7..)6..(0..&4...........................3..0M..0M..,H..!5...0...2..#9..(<..+A..&A..$@...J...H..-H..'C...;..&>..%9..$6...0..."...-..)C..*C..,F...!...................... 4..0M..-K..9N....y.w|..x.........S.....hq..fm........M...z.go..T[........K...{.ou..Zb....v.LM..#B..)@...!......................$9..1M..-L..5K.............................................................................WW.. =..'@...&.....................(%<..0L...M..-D.............................................................................."4(.(C..-H.........................2&=../L..-L..=R..............................................................................!5'.*F..*D...0.....................=(@..0L..$?..4>...............

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010001\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1719
                                                                                                                                                                                                      Entropy (8bit):7.252548529152065
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEV88yJ3V1aMbgSG1bVahoNN282Vn5ZrMq1lzkaBUgvy5:JwqNn2SqJ37iScbVz282rycFCMjM
                                                                                                                                                                                                      MD5:D3243F717AE59CF6FD7FB321481427F1
                                                                                                                                                                                                      SHA1:5E78AF0327B7E2DCF4B863C1C149B04ECD0E8537
                                                                                                                                                                                                      SHA-256:8AF0DF0967C780179FC269B318EF7DF3CFF75ACC2D8AF05CD55F43E4D902B49A
                                                                                                                                                                                                      SHA-512:A737EAC13EE0E43F9F42E522148F5EE5E45A8BFD35DAF18E531A9D521B1A217FF392E7D3EF6A8B5D0713CA6D2433B94BAA802485D4E041000350ED8C0ED2E2A1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DD2CEA94FE5211E1B530976CD51ECF8E" xmpMM:DocumentID="xmp.did:DD2CEA95FE5211E1B530976CD51ECF8E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DD2CEA92FE5211E1B530976CD51ECF8E" stRef:documentID="xmp.did:DD2CEA93FE5211E1B530976CD51ECF8E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>rS.....+IDATx.4S.o.D..f..]{7q...I.P(=...*@... .;*.#.O.....Q/9!q.!q..Is U....I..........b......7.1=..I`}...k ....n

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010003\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010003\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.950785833444288
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x4xVLH9VnJLKNbUQ5nnGKAX8VXzALysqcs57Jwyn:mVLH9zLKbd5nGK88FA7srt
                                                                                                                                                                                                      MD5:197E49C70C1EBF512A341E66AE824536
                                                                                                                                                                                                      SHA1:7593D5F3EE7375DA9B0CE7755569AC6DEBEBA7B6
                                                                                                                                                                                                      SHA-256:C27090AF8896DCDF6B3C59EBC486629426DD9532C00558B6081540FBA6856C20
                                                                                                                                                                                                      SHA-512:E9349BF6572CC3C7FBD13C17EA08FAA922517C1B030150F8065507A8CC1F1B7583DB0E405FBEF80955F92BCA3323D516820D7BB39FD9D2C32FB2A2E1B45C4CAA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010003..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/music.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010003\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.383412945466849
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:NPQjaRVJsbeyPJdA5eB6R4qkb3W0KgoIf34wvpkJs2kn:NoG1sbeyPJSeBVqS3W0KOf34wvpkJsF
                                                                                                                                                                                                      MD5:FC5B6A6E3EF44C5D19DC10876796EDB8
                                                                                                                                                                                                      SHA1:5139116462D20F03248FFB07202D86DDC10E66D5
                                                                                                                                                                                                      SHA-256:5ECFD31E8DF7784BFE3ED70AAE1E7F6D0AAF08A1E322FF20D07D34B5442A511A
                                                                                                                                                                                                      SHA-512:65433A7C12B63B349B13460C2751D3A5D31266D1B1087D5DF188BE5E01276FB887C6E189EC1D5A3D82A20BA073D42C3738916DEF288853165256DF15F7240A73
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..................................?{.f..g...g...g...g...g...g...g...g...h...i...i...i...i...i...i...i...h...g...g...g...g...g...g...g...d...r...*.........z!..]...g...g...g...g...g...g...h...i...j...k...l...m...m...m...m...m...l...k...j...h...g...g...g...g...g...g...c...]...+.:a.b...h...g...g...g...g...h...i...k...m...n...o...p...q...q...q...q...q...p...o...n...l...j...h...h...g...g...g...g...d...r...a..g...g...g...g...g...h...i...j...i...k...o...s...u...v...v...v...v...v...u...s...r...p...n...l...j...h...g...g...g...g...d..g...g...g...g...g...h...i...h...b...Y...Z...f...q...x...{...|...|...|...{...z...x...v...s...q...o...m...j...h...g...g...g...g...g...g...g...g...h...j...k...c...Q...V...W...Q...d...y......................}...{...x...u...s...p...m...j...h...g...g...g...g...g...g...h...j...n...m...`...t............l...s.....................~...}...{...z...v...s...p...m...j...h...g...g...g...g...g...i...l...p...l....0...........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010003\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):770
                                                                                                                                                                                                      Entropy (8bit):7.667667994524824
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:3aJ6Olfe4ojDeEwAZGoOXXJgwPEPvd6MYnE7:3glfe4ojDAAZ5g3MPlsE7
                                                                                                                                                                                                      MD5:8E73320DEA64E756C67D9C2469C3DDE9
                                                                                                                                                                                                      SHA1:D03EA57695890D7F4C735790AAACB7BDB41FBE76
                                                                                                                                                                                                      SHA-256:BB19792B94FBA34825A7C87B097A6FC1A215F13F6BA03A5C99011DC3BD523C09
                                                                                                                                                                                                      SHA-512:C47C93F47898E155EB91070325EB3212A8F05DC298DEA340B9124FABC4DC266BBAF88CB519C9C5E6A274423B05E5DD1205DB1320302937CA5AFC0E5FB5BF5931
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.dS?k.A.}3;{..\L..".Q..........`....".[....@l. .4. i4ELa.1...g0w{......^.p.....y......=....Nf.GR.8.....;.s0.k7/.|(...-.....7Q.........2...DU.Uq..S.RBF.CB.~...d.....3.".T.....`r.G...r.,..[02aL.y.......Ou..#+...w4...E...13Z.....6S<_."...Db...9.U..8.df.pv(.....4...s.htn...8.,b...]... C..p..k..+05R..:.zx....N..i"A.+7h.5Z...'A..t.....$...!.?.pD.SB.:.0..."..{r.PA..t^../.....'9P...`..1..-..r...S.E.AN.3.G..O.0w..m.c.cO...rX$......(..>..9..=U.v+g.RB.M.e...$g..@...........n..P..6..q.o..Q.6.EL.D.cz..9h...lA.V...~p...V...f.$.CQz.....GK...[.~Dm...p.........!.>.#p....T..../..h.V.].$.iV..P.,.;..........cC......$.EO..y R..4;..Z.%Rl..|.G........Dh....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010004\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010004\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.956344065029536
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xFWWVL/3Vn2NbUQ5nx5D+KAX8VXzALysqcs57Jwyn:3WWVL/3kbd5xwK88FA7srt
                                                                                                                                                                                                      MD5:877D7A2229337FC4B8F1BD42D959C2E2
                                                                                                                                                                                                      SHA1:962552190B139A59859B20BBF889676810203B90
                                                                                                                                                                                                      SHA-256:6F5D4CD8817A6B1A1E3FDCDBD3D4AB8F3A6B0137673F0DD839D3B7B3C9D0420D
                                                                                                                                                                                                      SHA-512:135DCC9DB8B2F1ABCCC8D6D9BFEFA1607A1D8AF8B64ED404C65F91E29200875A1D3BBADA647BA4C81FE0300BE364CB4DE5EDAC0B7859DFC3FA83291F9171A3B0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010004..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/video.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010004\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.525345605079403
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:oPgMlyfRfa3dPrS4msSfiVb1XASV2JVQTpX7y2NMCkD16AhEw+:TftatzS4mWZ1ASVIYpryQMCm+
                                                                                                                                                                                                      MD5:EE102FF1CC30D49E1EE94C957716A2F7
                                                                                                                                                                                                      SHA1:588455F5CAC8C600F9C109A8A9D36B04F12380A3
                                                                                                                                                                                                      SHA-256:D40F7483D0C9F5E99BBBA486788FD26F2CE850B4F4F0105B1C0340FB709FEFBC
                                                                                                                                                                                                      SHA-512:D0150E41BDDD0154A0B275337470AD0C61F0E54B915B733F40DE7E0D7EEBD7AC435D0C787B7EB6D4BC1B7658DB6F5B546D4DC59E8BC0DE72328F18F12ACBFD82
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ....................................#...1...0...0...0...0...1...0...0.../.......-.../..20..,0..,0..+0..#/..%0.."/...5...f...o...9...-.......0......................B..(Z.."T..$X..%[..'b..(j..+n..+t../z../.../...5...1...0...3~../|..1x..-r..*l..-i..+b..*`..)`..%[..$Z..&^....................#.*c..(k..(j..,n..+q..,u..*y..*}..(...,.../...)...-.../...0.../...-...+...+...,|..-y...x..,u..-r..*p..$k..(r...C..................%]..&c..,h../k..0l..1o..0r..-s..1x..;..$>}.!>...2.......2...3...1...0z../w../t../r../p..0n..1n../m..'h..$l...H................@.)b..*e..+f..)e..%d..%d..#c..#e..,s..+j...K..(c. 9|..3...%r..'s..*s..)m..*n..(k..(i..&g..'d..(g..+k..(i..'k...N................L.(c..*g..+h.."a...\...\...Z...[..!f..#`...D...H...P..,h..2p..$g...d...c..._...a..._...^..._...a..&g..'j..'l...N................Y.'d..+j..+g.."b..._...^...]...^..#d..#\...A...I...M...H...N..-b..1m...`..._...b...`...a..!c.."f..&k..(i..'m...V................b..i..,i..,i..#e...d...c...`...`..&

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010004\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3610
                                                                                                                                                                                                      Entropy (8bit):7.899292397711389
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/x6CuF4wgXk5Ic:bSHIIHUCD4waneSX4
                                                                                                                                                                                                      MD5:E78F57089427AA783749018543B1DA19
                                                                                                                                                                                                      SHA1:84C16B13CFE2F9B5F7ECA7BF3AD60CBC2C2BC1B6
                                                                                                                                                                                                      SHA-256:2287C37DFBDF981D6D24CF8E7B36D4AE3804D57629F28259B4F4987B4AE178BC
                                                                                                                                                                                                      SHA-512:DC11BDA55793E119B4A3E44D34B62C8805D929ED4B3155557AEFD97713F1738D1D44012B08FABA842498FAA4B697E79722EA97180BF6429A43D860061F39BB52
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010005\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010005\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                                      Entropy (8bit):4.9604710228149305
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x+VLqVnwX6NbUQ5n+MKAX8VXzALysqcs57Jwyn:MVLqnbd5+MK88FA7srt
                                                                                                                                                                                                      MD5:2808B6DD4F7D159D33D74AE710CE861D
                                                                                                                                                                                                      SHA1:B307A1327BE1420E183E1DEBAC4458F1885FCDA6
                                                                                                                                                                                                      SHA-256:88875896DDEEB7CFA205D20E29E9CB0B05EFE3848C9F8621DF3AB2335077A48A
                                                                                                                                                                                                      SHA-512:DE5DF30B2547F719403185531638A906C0EFAFB5B578BB3915412A7DCDF39715DE71E56BD3B036CEC6117178D489B1F9D2FF98B2E6643E1839B3177D74A0E6FE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010005..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/game.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010005\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.7310533928540135
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:Ig/FymEUfarNgg9pL91r8HlJjzE0137O0SIVTyr0KmTzo3VSTI0h:htxZOR8vI0d7O0Sw40NPTH
                                                                                                                                                                                                      MD5:3026ADAD9B11A1B6351FA78E74DDF068
                                                                                                                                                                                                      SHA1:FDCDF989FE0B230FD19A2E677E9AEBC971FE1F2E
                                                                                                                                                                                                      SHA-256:1EEBAA6B02555CDC06EA3AA1A7F1E88D19B660F33FB9EFBD2B06941D526541E8
                                                                                                                                                                                                      SHA-512:4F93AFC8D1B6826B1A74B3226773A142BB149F7873310F551B4C4D9DD357FACB20295AA763CEE62B8E4D6AB179DC5DBD856FC2A87C79EE31EE963D4D66D30058
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................Kl..Mv..Ai..Ju..)Xs..[~.!i..#j..#i..$k..(k..&i..%g..'i..'j..'h..&j..&k..%l..$k..#j.."j...b..,]{.Sx..Ho..U|..Gh..#%)*........!8E:r...w...}...i...K...d...................................................................h...\...t...........j...2GUM........'=KFz...x...}...q...J...c...................................................................Z...K...y...........}....5GW........(?OR............x...N...d...}...{...{...|...............................................|..._...O...~................2Ce........&=Kb............z...A{..?w..S...W...X...X...W...W...Z...[...]...\...]...]...[...[..._...^...L...F...}...............0FWu........,CSq............x...I...P...]...\...[...Z...Z...Z...Y...Z...[...Z...Y...Z...Y...Z...Y...Y...J...D...{...............9Tf.........5Rd.............u...R...w...................................................................e...N...x...............Ef{.........;Zn.w...........t...F..._...v...{...~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010005\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1013
                                                                                                                                                                                                      Entropy (8bit):7.737474544663215
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:7VnREjP+laJQEMkbGCbcZtIQ9D/Q0AMfak6:7VnREjPOLkb3batIQV4VGak6
                                                                                                                                                                                                      MD5:6C28A3D7F88C672AA3C3DDF1C71AB537
                                                                                                                                                                                                      SHA1:0B556894375739F5C9767D1E10DDD80FF25346DC
                                                                                                                                                                                                      SHA-256:B0B0FDD805CDD8C3A3A6167C6D3A328B5A8BCF08E75AA4B623B0D234E9A194E5
                                                                                                                                                                                                      SHA-512:597BA016011013A5F0CA26EBB25986DD1F023E946934871F92E109EEAEB8A42A51E11DB5483DE9EAB2B099A381F5A4D784274DFAAD0911B1A01CF346AEC212AC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.$..o.e.....$~&vb.q..p...Vm.B.. TT.Y..JT."....e.....,Z.BH,..]d.J..BE.8Q.fLL....{f.......s..!nqp..../p..-H.Wq}}...{/...g...?8V...G.P.......!|.h.a.}...@$y....).Y...'.......K.~Q1..Z.^.*..._..L_....~.m..8.aF.x.l..t}k.............OQ.;.W6.F..s..Rj9[6.... .&.Y.......;7..vAk^._...:........y....M2%7"....G._V.m..ML...J.n...w.pq9......G..F.p...sh~.9.....I..@....g...g..1.O..<f.{..jbP.Q.T.d.5....[............~..j...."34kj..^..@m$..G..+.Y$#S.*.....&.'.....#..t....K.p........0w....x.U.xgH..L.#/.A..!..I...x&....C|.......N...... 2.@..c/..K...4..'pi...mp.H.l.O*.I......g.BWm.K.`wj..>....tCWE....C0.0..F..Um ......i].\.|...........A.....3.S0...V.t@:.....q....Pa..R.v~...vW..h..D.s.D......}..F.#`s...5.............E.s..-.c...88n.....S......5X..i..l...J..-[.cp.9...C.3.s.c..v..Q.Q$..`.e..i......i46..wAt. .....A....{..%../.U.g.Z.Ig7..|H...v...\!..NP.......U...*.U...T.W.......o.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010006\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010006\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                                      Entropy (8bit):4.959938568668223
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xpVL/ehSVnYDNNbUQ5nmMKAX8VXzALysqcs57Jwyn:jVL/iSuzbd5mMK88FA7srt
                                                                                                                                                                                                      MD5:00431EF627E9B40E7B50C3586657D098
                                                                                                                                                                                                      SHA1:806C0F23726DA7A8DCE625AB8981DB2549D8838A
                                                                                                                                                                                                      SHA-256:39AFC8AD2F4ED178F5156862AEE0037FE410D84919AB6D3C588CC18A38820CD9
                                                                                                                                                                                                      SHA-512:A83A0AEE5C834A05CE2C34EF8445A6D67CCC92B98A4B6029ECA9475667D8D88773F4E58BE3D8914B104A5A2E81E3E1F3C206689E64D6264086EF7C1761F917F3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010006..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/life.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010006\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.123923091383425
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:GUREDVOEUKU+ptPitr73rYbRuaYN65w2d1x16T2/mt05I+s:GUNEUKU0hur774RGN63Xo9
                                                                                                                                                                                                      MD5:BC39369552A83C4605FB197B6D4E076F
                                                                                                                                                                                                      SHA1:227D9F5AEAFC9A58B3EA8382214122D6603263D7
                                                                                                                                                                                                      SHA-256:688E832FE0C40A7CF4E5195EF9CB36914B1FABA99DE324B7865BCA2F43C686F5
                                                                                                                                                                                                      SHA-512:F29CDEBDFD15522853A27F5D266008CFAA1BF72C43D522F9B9AB70B54E69B3227B755AE212F2156EAA391651E323E6DA80BD1157DBEB0149AC6081754F30D648
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................|||.............wwwy___=]]]<^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=___=___=^^^=[[[<kkkA.......................................e.............................................................................................................S...........q...................................................................................................................a...........{...................................................................................................................l...............................................................d...[...t......................................................w.......................................................9.n.B.k.}.......`.~.*.^.m..................................................................................................".c.........................:.h.R.......................................................................................a.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010006\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1690
                                                                                                                                                                                                      Entropy (8bit):7.272208627759569
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVFLeT3yJ3VCLuG2dif/lXIrlss8t8Ig3XGi8/t/UYAieL9:QWHNn2qfaiJ3KuAJIt2WXGDV/4VLDwI7
                                                                                                                                                                                                      MD5:9DB9DB4903D7E1AD0B26FD00F63982D6
                                                                                                                                                                                                      SHA1:F5B1C5095D946DFD0C98EB143CD17F01E17B4377
                                                                                                                                                                                                      SHA-256:686A61AF03640B0BAEB5946D06F3A0E5D0E146F767429B76EE5733D0F9D1A116
                                                                                                                                                                                                      SHA-512:CDF363DCCAD5D997253DB4F1B53FD07B0B19332DFFD5EC4FD868768EED497A3C4A5AFDAC7E00982E011184074F5760BBF22391BA95AB5EA3CBE56799F4552F6F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:FAB7FA9FFE5311E18FAB9597E2C2E77B" xmpMM:DocumentID="xmp.did:FAB7FAA0FE5311E18FAB9597E2C2E77B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FAB7FA9DFE5311E18FAB9597E2C2E77B" stRef:documentID="xmp.did:FAB7FA9EFE5311E18FAB9597E2C2E77B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.8]8....IDATx.$S.o.E.........(.s..v.( AG..4!.H..h..P!Q ...R.?AtiR.....$......r..K..........f..f..........-.|G.....?xy....r.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010008\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010008\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                                      Entropy (8bit):4.96354868738225
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xTVLuXVnIkNNbUQ5npWp0oMKAX8VXzALysqcs57Jwyn:5VLuXSQbd5pNZK88FA7srt
                                                                                                                                                                                                      MD5:C044B9480270FB60A72E994D7CFBBC0B
                                                                                                                                                                                                      SHA1:76001BC99F03C05C9C10326DA9D04F4E5E4D1E5E
                                                                                                                                                                                                      SHA-256:69FCA65D70DE780130CD6416B4332138E465035EE966FD52D8955646C6A7767A
                                                                                                                                                                                                      SHA-512:076ED3587BAB4FF6FEBC7F9D54D74A1A37B885162E939B26388810421EB811C75B7F78F51BDCEFABC214B517952FFA13EBBF08B9391571F7871DB4A4FC1A5BF1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010008..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/fashion.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010008\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.664757497114004
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:Ms5EgVHimUP2rbGknnpF6UuVoE1mRVY7uV8fSNWYfhl8/FJ0+6AN:t7Hn/rbGMpkUuV6zYuuSNWYir0+D
                                                                                                                                                                                                      MD5:F023EC5F28C4652DE4EB7997B7B2125F
                                                                                                                                                                                                      SHA1:D20156CC75F64EC63A9C4086308714E6FFB5FF31
                                                                                                                                                                                                      SHA-256:1E395B7D62ABF73CBDD83FF9DA0FA125C29C330998F04B8F8E31911F88F1B43B
                                                                                                                                                                                                      SHA-512:6514396B8DFE68C5340C13389F11A5C0DA7A1B5EB8A97AA9CD8C8BE1403FFCD9262F2AAAB22E8B548F3116C33233DFBD7105BB7FC8E92622CD4925C86C8EF8C2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................``a8...s...p...oxr}oy_.k~a.i~b.j|d.j.e.i.f.i.g.i~h.i.g.i.g.i.g.h~g.i.f.i.e.i{d.i|c.i~a.iy_.jxp.p...r...p...s`_a<................/0/......~..lV{.O.~._...i...e...`...n...t...l...i...x...y...l...k...s...p...b...c...h..._...O...kP|..x......FEH.................X^T.....s$..y ..x(...+.......2...6...9...;...=...>...?...>...?...=...:...7...5...0...-...+..x&..y!..y*..........???.............dp]..P..z....1...5...3...4...7...9...<...=...@...A...@...?...>...=...;...;...8...6...2...0.../...0..."...T......MLL.............F:P.v&..w...y...t...............}...........................................................w...x...y...y&..ZJd................,.Z.l...w...t...n...............u...............|...........................{...~...........q...r...v...m...*.Y................:.m.t...~...v...r...............|...............~...........................................v...v...{...s...7.k..#..........,B.x.z.......{...z.................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010008\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1827
                                                                                                                                                                                                      Entropy (8bit):7.3468622709312745
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:JwqNn2SJXatJ3E65j2WfLnVbZ9Hd4zGlvpkr:12h2gbDHdO
                                                                                                                                                                                                      MD5:FB6F20EC94D8F6620BC4813CFD21E07C
                                                                                                                                                                                                      SHA1:C9330A96AC7CBD4C30A7C67EBD96763339FBB23B
                                                                                                                                                                                                      SHA-256:504FA6DBF57662A4F6AD692981E0772EDAF516D577DC9C73F0FF4BA856ACD8A1
                                                                                                                                                                                                      SHA-512:3E1655C6B1DBECBF46F6842FAA0006F3E719651DDEDEFFA0C707412A5FD7BE07B1E97B915A1B16B0F5FD7625FD6CC91268470EACFDDCB5FC8B800B1264439105
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:EFA7C054FE5211E195E3932ABDA7E579" xmpMM:DocumentID="xmp.did:EFA7C055FE5211E195E3932ABDA7E579"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EFA7C052FE5211E195E3932ABDA7E579" stRef:documentID="xmp.did:EFA7C053FE5211E195E3932ABDA7E579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Q]O\U.].s..;.03.P....".$...hS..T.....}3......&&&.'}3Qb....T..M..%B....3..0_...8.x.a...v...4..?Z..3

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010009\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010009\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.962132144658908
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xixVL7rVnmNbUQ5nlMKAX8VXzALysqcs57Jwyn:cxVL/0bd5lMK88FA7srt
                                                                                                                                                                                                      MD5:46ED24D9C05D2FF8C25F2514E71AC4DE
                                                                                                                                                                                                      SHA1:12862A40DAEBD9D306D88E903E355A298EDA55CF
                                                                                                                                                                                                      SHA-256:4D8522BC9D0F4667943DD00526F6317E533F8E9D11F9459AF03B646C26D127A8
                                                                                                                                                                                                      SHA-512:C0C42E208EB9A781565A66D4B25432BAE452D0F2F7C26491809D2AE9823659F6520D03040535EDEF50B298D08C53371AB736B8FC220BE81F278BE4F37CD45D2E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010009..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/tools.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010009\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):4.950724673411782
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:6LRdUSYknCN8AC88mHmjOZahs1JDlg3rl15tz8wnSQ3h0YoDoWSsiu0mtb7AqwCH:1TknCYjbjggoar7z8wSY0TrScspL6
                                                                                                                                                                                                      MD5:5ECDCCB9FC99BD54FAFA7B66AAFA8E98
                                                                                                                                                                                                      SHA1:4864F297BECCFA356E0C4BD52E7957A5DAC30E61
                                                                                                                                                                                                      SHA-256:EEA96B28EC5B0004E0728D9C633C428287C64D80D6D65984B2DA5A38EB064B91
                                                                                                                                                                                                      SHA-512:059634684795CB0B16E37188AFE3858A6DDFEF4B89F83BEB120FDF9B8C5E145C81C5A8F54B26B75D87162E5D2BCE9ECC0134D2E9B7842C2471EFADA2B6BB8512
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .............................8;?.%..k#..v"..s"..s...s...s%..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s%..s...s...s!..s!..s!..t"..x3Ta2............1Si@............................................................................................................&...............*WnG............................................................................................................................#_{K............................................................................................................ ................j.W.............................................................................................................................s.a................................3..............................................................................................g....................................................).........................................................................s..................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010009\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1573
                                                                                                                                                                                                      Entropy (8bit):7.156172199592931
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVz/BoyJ3V8peGY2x8Ewb7RQH9wTdMxCKiInW8oOPh9+P:QWHNn2qHrJ3yeJE8f72i6v3f5JUP
                                                                                                                                                                                                      MD5:839BED271E6C514A5D2EB7B71E6D4B11
                                                                                                                                                                                                      SHA1:97B4D4D8178C0E92A47DF236EE8B9067E6E0474E
                                                                                                                                                                                                      SHA-256:3D927AA49B006349F65C5D17CECFDB7B0066367F768ADE0A70A3C0D34EDC0E90
                                                                                                                                                                                                      SHA-512:4496DE05F886E7D0EBC066C5F69AF30D84D180517C9A4ECB4C445389106B7B8E6E53985EBC4296D99DE2A1A5828EDFF30C5610494FCB98E0D7AC21417C67FC21
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:00C3D49FFE5411E18077E37066175716" xmpMM:DocumentID="xmp.did:00C3D4A0FE5411E18077E37066175716"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00C3D49DFE5411E18077E37066175716" stRef:documentID="xmp.did:00C3D49EFE5411E18077E37066175716"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..az....IDATx.L..j.Q...s..W..t.T..[..J-Y...P....@....gP..+..+..,.m.....6.6.$.u.w...~.;.s..Qj..,....T7P.g..?.Y.XaP.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010011\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010011\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                      Entropy (8bit):4.949950243042386
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xkmVLeVnBqKNbUQ5nfI5MKAX8VXzALysqcs57Jwyn:ymVLe3qKbd5jK88FA7srt
                                                                                                                                                                                                      MD5:26312D153000D2C2F383C0F630E64E15
                                                                                                                                                                                                      SHA1:9FD24B4EACD050A4242F8C18A2F94FC1BE9E2B04
                                                                                                                                                                                                      SHA-256:2EAC776D15900830F6E53E15E6FE876DDDCE8E6AB0B247AA47DB1E7180905CD1
                                                                                                                                                                                                      SHA-512:9F24BA99E85909F9C6A106D9A12365C525FF6537DFF525B081859DC901495FCA204B5961EA201D685FC31C31BAB848443AEFC958CDAB3038B2E34E4B541B9B58
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010011..version=1.0.0.1001..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/mini/novel.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010011\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1150
                                                                                                                                                                                                      Entropy (8bit):6.696759280646044
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:WWxaAbGln2PbNPx4vHfGd89oDpMZvf6Rbqr:WWx/c4wvHfs86DpMZvfqA
                                                                                                                                                                                                      MD5:1C4DCAC9F552D56878D4A52FCAC1A7DF
                                                                                                                                                                                                      SHA1:F188EF7E761D206FD1274AAE2F05431C012B3B81
                                                                                                                                                                                                      SHA-256:4272C8895326A053B5DB012715BE6E925DEAC6C5686B385E231DB02A3E95D41B
                                                                                                                                                                                                      SHA-512:949584652F9EF91ACACCE97D616F8D183F0D2AEC7ABDEB659F3E24DFFBA06D3F2EF83F503D87379FAF7EE32F5C48256F2B8564CA6CF4163D22014B97091FC1EA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:............ .h.......(....... ..... .....@...................1[hZd{p.bT0.XY?.<h...>...9..6\}.*My..4z.)R..8h...3y..=..E.../W[/<q|.vQ..yM..{H..**R...........p...p.......s..${..........@..1ipJ7^a.wP..uT..|J..-%N......"....u...t..@...&~...|..#...$...3..0juS9UQ.s\(.ee8..K..,$R..B...>....z...x..?...(.......(...P...;.."HQaC[T.r_..clC..K..)%^..I...B..."....{..e...@.......)...d...<..%N[oM_S.vf8.`{\..L..&&g..R...L...(.......W...=.......-...q...=...ct{UdU.zb/.hqH..O..$(r..N...H...0..."...Z...@.......0...Y...9..+bz.]jZ.`..}o/..P..!+}..A...?...6...&...<...1...!...2...K...9..#Tn.ry\.w.......a...4...W...S...D...%...?...3.......8...S...D..%Y|.s{R./...;..e...8..2h..0c...I...5..:R..$;.......H..9l...K...V..l............}n.PH|.........F\..............................0c..s...............l|..........`r..............[x..............Gfjt(<AK........................Uv......................................s......................Jx..x.......................Q|..........(8=%Ioxrn..............)K..>l.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010011\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):992
                                                                                                                                                                                                      Entropy (8bit):7.7713387585355544
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:A0BZmIxT556WHubIfgZwEt0Frl/S29T3WjvNepc:feilcfIfI/ErlS2VOei
                                                                                                                                                                                                      MD5:844DDCA1D925E71E9B64DD39EF95735C
                                                                                                                                                                                                      SHA1:12B52B95064E670B5C0DD0C1AAD4E1850537791D
                                                                                                                                                                                                      SHA-256:4FE063A8E4F55F31B647CF4EAA29B3C1C77642A912582DAE0C7687133EF5CF2E
                                                                                                                                                                                                      SHA-512:2573314F71A0F1DB258C34C9517C12710A32D60D83EEC7DAA15536D6EDC3B7136FAA7256D9DEF79BD1724C8A8D400695850BD04CCEF1AF55922BB9F5897DCACA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..SKh.U.=....y%3..$d.4..ABq..%R..@.)Yt%j.RQ.n...]Ku.. ..U.......J...j.G......u..v...{............"?.Cz 6v...c.....6.F.rc......~[..]..Z.z.\j..$.H.......+K.g_-=3.88:5l...w.|..xqh..w.D....{.[[{.w.V....kW....;..........."..P.D...#.(...g)K.".:.+....&....pb}..>.|..rb.....Q...).........*....3.Y...........#C..}...o3.G......K..A{^.~Q)..Rf.AsH....?..{..*U.....3'.w..;...pe]....yNM...V.#...."........}G..el....<8io.c._..OT.Q.._.o`..1."Q....:......*&.c.x..y....)..I...O.Q.L84....6".4y.n.C2..B.ohQ$.-.._....3][.5?.."...f+K..*U]e.......8........Eh.{....R.B?G].h...'-..P....Ip.Hj"..!.q...n.&..Q.:.R.C/a......%.&.65..$.F.T...._J.8$.-0b.......e.2......@..W.X..n.X.....|.......r-...=F...5...E......6P(...y..Y.C.^]>.....r+.c\.5... ......~...Hb$..J..q..-S.L.3.....9.M4:.mz.a;..>H.i...0......t....`..g i>0V...G..W.Q2..tdP..'!....(...Q.I.'....T6..I....QU.S}........... .....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010012\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010012\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                                      Entropy (8bit):5.025645351265841
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xiovVVLHS9VnawDmNNbUQ5nuMKAX8VXzALysqcs57Jwyn:5VVLy9PDmPbd5uMK88FA7srt
                                                                                                                                                                                                      MD5:D4E12D133CE4E63D87FDE596EDAC6D7E
                                                                                                                                                                                                      SHA1:B433F4E9765670DAFCDCB9A6CB2FD7698AAE393B
                                                                                                                                                                                                      SHA-256:9406E9933AC0D54302654482A0DA93ED7981E11C93E6D890CB591CB5542F4FF8
                                                                                                                                                                                                      SHA-512:216AF6837F4DB96E5E0CAD0F0C5965AEC7156EA0CC4BFB7046D156BF8C8C19BE18290C6EDC6CEBF4C7B1D9C2216A2DA51DE6A5B4B1091D7944CB70217F636DFC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=102395752..version=1.0.0.1002..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/picture.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010012\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):5.306748975761254
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:j/ezRWrNDg/nHfXMw/IQUr7jR3yIflOnxjSROQjhZ:j2VW5DSfXMyUH1llO8RBjhZ
                                                                                                                                                                                                      MD5:39F1AF5D20B5FA3BD8A9446A08E3F6A8
                                                                                                                                                                                                      SHA1:5070BA1EE5D7D3596977B8E6B7C38CF12B492C16
                                                                                                                                                                                                      SHA-256:50D0F6832BA9490B64C43EAF5EFDCC5F8D5641616047DD6065ECE79B0EBDC3F1
                                                                                                                                                                                                      SHA-512:8BFC8F7526C01ED99668996BBF1439B6AF0DC72FF6A4702BF234B4DBC1F72B0DACBE71510F2BF84092DA820D228303D6A3CD582FFD73D61DADCA86C08E534A5B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...I...S...T...T...T...T...T...T...S...S...S...S...S...S...T...T...T...T...S...U...U...U...V...W...W...W...U...S...T...T...T...T...T...T...M...4..........................................."...^..................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010012\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1707
                                                                                                                                                                                                      Entropy (8bit):7.290497360373356
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:QWHNn2qUfJ3r/3B+p8WjcGE1g/gmj2ggbLC0Y7:lt23h/3B+pdTE1gPj2ggbO57
                                                                                                                                                                                                      MD5:16F57A2638753B17F72DEFABE38E53CF
                                                                                                                                                                                                      SHA1:78D7687CAE55FBC059FA2AD6BBFD97B3567B3122
                                                                                                                                                                                                      SHA-256:A5A4143320D633EDB78AEFA71F585888D58EBB1DDF6F6CFD20A61749B1523486
                                                                                                                                                                                                      SHA-512:3C3973196D100CC8CE279C40F6A8C8FD7954FA89EB77AC655C2E174279534A2A4E02E13AD5DA2E64415B40459170A0EAFE2F13BA6C07B755766BE297C0150E45
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7BB909554FE811E292EF98C5F7C4FE29" xmpMM:DocumentID="xmp.did:7BB909564FE811E292EF98C5F7C4FE29"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BB909534FE811E292EF98C5F7C4FE29" stRef:documentID="xmp.did:7BB909544FE811E292EF98C5F7C4FE29"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..vV...)IDATx..MLTW........g`.....7"...B.h...&M.....6.&..n.B.&.%a.6iH.IjR.M.5.q.`.# 0.....y.....E.'...'.s.....,..........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010013\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010013\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):321
                                                                                                                                                                                                      Entropy (8bit):4.9662771090398525
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xVxVL0SXBVnXXKNbUQ5nVKKAX8VXzALysqcs57Jwyn:VVLJB1Kbd5EK88FA7srt
                                                                                                                                                                                                      MD5:4720DA30ACD35F7061A009BF12097431
                                                                                                                                                                                                      SHA1:4458795E744C92A6D3891AEBF0A0716896E8957E
                                                                                                                                                                                                      SHA-256:423B5D3027D9F7F47168244DA4DEE695B2FC330C11E11BD622660FF199BE6D65
                                                                                                                                                                                                      SHA-512:DCF023B0D3A2F4B550F0204BBADC7D74350F81035593C77361880635BAD00A4BC3AC03BF05688C7D0EDB240983C65892B964FB7582A004605417D3DD1E5449C9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010013..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/investment.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010013\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):5.800853721893965
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:haFaj+hpA4r/fcuLM2iji5PS6QHKcE9JvIHxJgFqsZXQFETuPDUvdsjd5w+XkG7J:h+Q+h+C/M2hQHKvfgsZXAIvCjMOkG7q0
                                                                                                                                                                                                      MD5:1D03B03E28B1F81EA1B58CE87A667E07
                                                                                                                                                                                                      SHA1:D98DE8B7B172475982EDB9EAC227AAB77A08A17A
                                                                                                                                                                                                      SHA-256:197E99F7DB21D5776B92F4D1420174B98D82B1F5EAB25D3D9946B802D4885727
                                                                                                                                                                                                      SHA-512:914A503E060FB6FB2A6A99705477B2955B460C0B4AF80182C9E1EBD21A337C89A2A242AFE9769BDD29448DCD8430FE5809EFD412DB4245CBA53E8C4162C0B6B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................B..,._..^..Y..Z..Z..\..]..^..`..b..c..d..e..f..f..e..d..c..a.._..^..\..[..Z..Z..`..X..P/.!............O".J.q...f..._...a...a...b...c...e...g...i...j...l...m...n...m...m...l...j...h...f...d...c...a...a...`...g...i..X4.6............U%.U.o...b...]...^...]..._...`...a...c...d...f...h...h...i...i...h...g...e...d...b...a..._...^...^...^...d...f..Z5.8............V&.U.o...b...\...b...e...\..._...`...b...d...f...g...h...i...i...h...g...e...d...b...`..._...^...^...^...c...g..^7.<............\).c.p...b...P...L...d...h...^...`...c...e...l...l...i...j...j...i...h...g...d...c...a..._...^...^...^...b...j..g<.N............`+.h.p...a...S...E...J...b...k...a...e..._...\...o...r...j...k...k...j...n...j...c...c...a...`...^...^...a...j..i=.Q............b,.l.p...`...`...W...I...L...b...p...a...X...X...]...r...w...m...n...h...a...q...m...d...c...b...`..._...`...l..rB.Z............m2...p..._...^...b...\...N...Q...`

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010013\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1676
                                                                                                                                                                                                      Entropy (8bit):7.212829335167512
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVKwfyJ3VF5G54o6B+DJtHQdHecKMdPP1oOGtVvvhPaq:JwqNn2SvKJ3d0bL2+viPyO6Pa05d
                                                                                                                                                                                                      MD5:9CD270D5DD770AAC24E31A354622B6F3
                                                                                                                                                                                                      SHA1:556EB8862702CE14A365BDAEBEB37B7B8BB8BB2B
                                                                                                                                                                                                      SHA-256:E3A5419CAF661070EC8FAA0B2104CDE36A278B788829DA077CBA1E68F3794A34
                                                                                                                                                                                                      SHA-512:8511232D87EEAA380F22B6683F2F1A4C78F2D7F0D5D91F6633A7BAB793B07EA80F6A40E46E43F17B9281C35D791C6AC8B48120F914C88CB5B509625C501C088E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:020B3D84FE5311E1AED0CEE83748DAC3" xmpMM:DocumentID="xmp.did:020B3D85FE5311E1AED0CEE83748DAC3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:020B3D82FE5311E1AED0CEE83748DAC3" stRef:documentID="xmp.did:020B3D83FE5311E1AED0CEE83748DAC3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,..F....IDATx.$R;l.W.=.3;.k{m....e..AB2."D.(...!. Q.@.D.M..iRP.KK.&..R.....!..l......^........4zs.=....?..@.....j.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010018\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010018\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                                      Entropy (8bit):4.967324401143455
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:x9WVLdVnSuYNNbUQ5n2m9mMKAX8VXzALysqcs57Jwyn:yVLdcuYPbd52m9mMK88FA7srt
                                                                                                                                                                                                      MD5:2A0E5B9F974C4CF0F01B6B916FD959B6
                                                                                                                                                                                                      SHA1:60CA4EB38BCFBA4DA1AAB07BF964642B0878FA0C
                                                                                                                                                                                                      SHA-256:08594A9454BE5376EAF97020DFFC1497A147CC0CDAB6D7C4A1ECF04F0E86B4BD
                                                                                                                                                                                                      SHA-512:E054BB158849E7C6596E8AE0B7CF641C21CF2D5211388E6DF1ED2935282889C7F5162B15EFA50E6B2FDFD98BB3ECA15BD62999DC78C665282AB36B1B54B2BE0A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41010018..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/shopping.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010018\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.244375588470727
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:80oBnFFn1dAxOLarnebhRA+vMUvu5PZvuagihZNZv9XXgoFs2tiOCfnzP6oe9nd:8TdT1exOurneVtEUyyyNngoFH8nT6zd
                                                                                                                                                                                                      MD5:39C449DFD4172C8FEF4D79D8F3ECF019
                                                                                                                                                                                                      SHA1:B76585CD211E0BD19328FFB6A6BA306BC6245C4F
                                                                                                                                                                                                      SHA-256:C0FF5EEA0BFF68D6A67AA730C16E704AF401CF5A60E5DEB7BD56E791F0A7F78C
                                                                                                                                                                                                      SHA-512:B2C8BAA61223A3A995CC9827B1F8134A77594109495040081D399FE49391D56297A7E23DE71216537C747E068407A59147C6E41E35A8D5B1442E0AA7D0A44D00
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................&...6...>...C...G...I...M...P...S...W ..X"..\#..\#..`%..]$..]#..Y"..Z!..T...S...M...L...H...F...A...;...4.....l.................aN.-.p.2.x.5.}.8...8...;...;...>...>...@...A...F...@...D...D...A...?...>...=...;...:...7...8...5.|.1.u.,.m..9..................S...o...{...........................................|..z..........................................v...o...6aa.................U...u.......................................}..........................................................n...:ol................(B...e...................................e.......q..5.u.<.~.y..v..n...............................}...[../sn.............. .:Q...r...............................i.......g..%.c.+.n.&.i.!.`.l..w..s...............................h...>................$#FY...|...........................x..........8.r.k..=.|.#.b.\..C...~..p...............................s...C.................-Qd.............................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41010018\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1754
                                                                                                                                                                                                      Entropy (8bit):7.285789734958503
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:JwqNn2S2J3rJvlpu22AjzCy5bOONHYkW5tLbZ:12Z62lzCiNHYkWTbZ
                                                                                                                                                                                                      MD5:D4C8F1DF118F8FC64AA4DDDC31F29697
                                                                                                                                                                                                      SHA1:7AE57827226012EE65A4893A8070A9775F28A084
                                                                                                                                                                                                      SHA-256:6B6F88BADF77410D370E663BC2B3980C1C48FBD52BAF156D86673EFB7F88D213
                                                                                                                                                                                                      SHA-512:6B20F93F7213C37EFB1F684FAE64F115A32DED84108E42A54FD5A55ABB80DA87DB68C5CFE60460388F18DB3B359964B06635C6F0E1BB2500CB38431A0077A1DC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:CA5BDE84FE5211E181C6F1422FB0459B" xmpMM:DocumentID="xmp.did:CA5BDE85FE5211E181C6F1422FB0459B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CA5BDE82FE5211E181C6F1422FB0459B" stRef:documentID="xmp.did:CA5BDE83FE5211E181C6F1422FB0459B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>9......NIDATx.d.;l.U...y...........$2....XD...........$$...@"4H....&.H)(....$H....;q0.........w.:.tns...9..+e..{......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020002\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020002\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                                      Entropy (8bit):4.9686066710509476
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xViVVLZVnkJNNbUQ5nVlL9MKAX8VXzALysqcs57Jwyn:oVLZ6Pbd5Vl5MK88FA7srt
                                                                                                                                                                                                      MD5:183747990356B87208C54FE122A7AD2C
                                                                                                                                                                                                      SHA1:4296A5E0BB5B62A4E973E67CEB590484654332FB
                                                                                                                                                                                                      SHA-256:94AED96FF80D2052397990FADAC17F56F2E2F810F39A9A20157D2AF7F44A7278
                                                                                                                                                                                                      SHA-512:F70453499C91806D3DDEB64CDC24DBDD222C8E7BDDE7BA24BF6E893A4494CFA184A4A3DC1DBE8D0583A2A79C4A8444B8113F6A0271150853F142468EEB2C7849
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020002..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/news.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020002\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.502356981324228
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:KeCgIIwzEW5T4AN+8afhZ1tT6wVPIaCs0LH2AmW:KerIIwzBT4ANnar18wVPxqLWAD
                                                                                                                                                                                                      MD5:D476ABA8D99BBF39C7CA914BBF30DD35
                                                                                                                                                                                                      SHA1:5DF2375B3EBA919244D26A00E78DCA264A4C076D
                                                                                                                                                                                                      SHA-256:93EF9FB51A4142EC5407799A0048ADE165E3EA335B2179BBE7E2B0917EB56858
                                                                                                                                                                                                      SHA-512:664D6771A0B74BBE57C490ECB790B9C0CF1881367B13BF5E74DCE939D39E30C804A2755FA9C52D83F562958764C5B2C946A14AA13F2A4C3466EEADC7029F1DD3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................................................................................................................................................Cs..7h..<k..An..Ao..Du..Fw..I{..P...W...Z...]...\...\...Y...X...S...M}..K{..Gw..Du..@r..<r..;n..<m..7l..?s.Y....................-Z..5\..9e..?h..Ck..Mu..T}..`...l...t...~...................}...q...k...`...T...Mw..Bn..?m..;i..7e...]../g......................2]..Ck..Iq..Mw..P}..W..._...j...r...x...........................v...q...g...^...X...P}..P}..Jw..Ep..<h..2j......................6a..Jq..Qz..W...Y...^...c...l...u...y.......................}...u...t...n...b..._...Y...Y...S...Ny..Bo..4j......................:d..Rv..X..._...a...d...f...n...He..+DY.[}......^...'CV.Gg..~...e....FX.5Ri.b...f...a...a...Z...T~..Hs..6j......................=e..V{..]...d...g...j...l...f...%@S..0A.9Yr.....Ee...7H.Hi..}...Z}...9J.0Of.g...j...h...e..._...W...Mw..7k..?r..................=e..W~.._...g...k...m...k...p.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020002\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1747
                                                                                                                                                                                                      Entropy (8bit):7.285774204678194
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVQlKFyJ3VagAqGdqIWoT3gmDRaLhXN5JXK3bmZ00dUO:JwqNn2SuJ3VPIWq3aLFN5U3bmHKdC//
                                                                                                                                                                                                      MD5:571AF2707D1147E42B208A5B98F98BDE
                                                                                                                                                                                                      SHA1:38E75672641FC4C836EDBF11473C362B8729363B
                                                                                                                                                                                                      SHA-256:2F22D05B68B3A16479AE3D04686E2E422A8E734D1A26B2FCDC2A795979E8C832
                                                                                                                                                                                                      SHA-512:F073602044EEDC1FDD1F05EB0E5B71284A392FC88C2692AA5C40A2E67CDFFD2647DE00A998A0E5D131C30744EA9820604280EE492E6699C6652AE0B4E7B23DF8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:1877BFD4FE5311E1B6A8F56F97B9BCDF" xmpMM:DocumentID="xmp.did:1877BFD5FE5311E1B6A8F56F97B9BCDF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1877BFD2FE5311E1B6A8F56F97B9BCDF" stRef:documentID="xmp.did:1877BFD3FE5311E1B6A8F56F97B9BCDF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..?....GIDATx.4RMh\U.=.}..7?.L'.dL...*...R*. .....E....u....].(.u.R.*"BH.A.U.$N.4...y....K...{..s...03d./8y......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020006\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020006\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):326
                                                                                                                                                                                                      Entropy (8bit):5.047002109476319
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xV4VL9zKVnCKNbUQ5n/ky9MKAX8VXzALysqcs57Jwyn:8VLwUKbd5/tMK88FA7srt
                                                                                                                                                                                                      MD5:B3010D5013CE394490FDD675EACFFEE1
                                                                                                                                                                                                      SHA1:980A80543CF558C5B9C95E8B193DD1D27A2553CA
                                                                                                                                                                                                      SHA-256:EF20DB1DE1250B46ACB32D5C1CE97F085FD67AFA421CF6F2DE6CD1F3A2042542
                                                                                                                                                                                                      SHA-512:ADF00AE70CE375C535EDF3ACC7CEB48353B856A2F1D326E1D79A36EC9C72DCB486BA9DCAF4BA9DDAFC9637CEF4A22FE12D170C3EA0B636425AF6D506AF286B32
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020006..version=1.0.0.1001..name=..............[AppSetting]..icon=logo.png..smicon=logo.ico..title=............url=http://static.apc.360.cn/cms/mini/magzine.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020006\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.306713577547797
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:UM0mIfogLvt1rp5q0afKkwCrzT6vwXiZESw:UM0x/D7rDqFSNCrzT68
                                                                                                                                                                                                      MD5:3F913DE1863481A1EB2D4400DF2981F1
                                                                                                                                                                                                      SHA1:DDE8678AC1DDFEF0A6EE438CF4BF32E7B6274C63
                                                                                                                                                                                                      SHA-256:5F5A309335670B3B63147D061C5C4523A656A43B44E9FD6BC5B77B057D76DA08
                                                                                                                                                                                                      SHA-512:0F71EBAA314E6D7B62F90B463F466832678388E59E5AECFC46259400E0696E2DD24404CB51A57211EF6D838CACC04FDF820ED1CDBD23768525B8B44BE3E342CD
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................FFF/rrr.ppp.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.oon.oon.ooo.ooo.ooo.ooo.ooo.ooo.ooo.sss.bbbh................uvvv............................................................................................................XXX.....................................................................................b....................................lll ........................................................................................+.................................iii&.....................................................................................I.......$............................KKK0........iii.........................................................................u.../...e.....]...-...J..K..U.........SRR6........}~~.........................................................................F...............Q....9.....5.........bccC..............................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020006\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):939
                                                                                                                                                                                                      Entropy (8bit):7.715337267518902
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:TgnmyMGQ6rbGPaBviHyDAdqrlGJvk60U5:T8AIbGPaligdUvz02
                                                                                                                                                                                                      MD5:2D40368B62CCAB60F49FA64586721507
                                                                                                                                                                                                      SHA1:209354B6EB8543E4E5006CC565518888E26A5F25
                                                                                                                                                                                                      SHA-256:106EE2D49EDCC53D777C46ED92E94D552424D5EDC1240A4D13CEBF7240BA004D
                                                                                                                                                                                                      SHA-512:F6331635FCF499B090DBF6F3D42C3476A35B6A8E0DF8ED55358C29DA4B938315E4CE2CAB3E2884D12B7B65FD9DC5EC05D4B35D887ACCCBC86ECC90305E7B3D1C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..S[k.e.~f......nvvc..mk+V.....Ik..(...(.^.......j..!x#.w....x(..sE...l.4.f7.=.y>..>...y..y..8...|.....5gu....f. BV....Q..S$..%....5.:0..7.o..es.....>o...j.OpMB.bb4.@.5........;..C.=.+...W.XE?#.P..UK......n\..@e..N`...a.....j?.$"<.0&3.R....g..{B*....H:...gI...B.%.2..#8..L...w[.8..Vmb!....'...GO^..`....PX<.k.=F.!.Z..9D9E..8...-s../.P.&>x......{E-:._4.d....a...LL9......=uf.......t.r0x.&[.-...*..D..$.dYF..0..&..4{$jA.H.4c......;.uG.....'.9...p]..j..O..Q..a...".)R...eY......F.s_.u9.`.6.8.O.3.c..a.7....p...R..#.X}"-.....B.@Z%...".p..\(........e...J.r....N#._..sP...)....K.sH8......`."..eL..........:g#f$.i""........Y..}....(.......~:..G..,O.8...y....N'.....h.X.I..aU...........#.,....P.Y...!.T.`.$...?o....^.......&T./P.I..v%.(.4.....R.-O.....,....ah..bW..n?.lnn.'=....QQ.KC.j..o.....W..r..P.{..A..v..`...6{_.{....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020010\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020010\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):322
                                                                                                                                                                                                      Entropy (8bit):4.990346257397384
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xJuWVLNxVnJwNbUQ5ne0oMKAX8VXzALysqcs57Jwyn:+WVLNxUbd5ZZK88FA7srt
                                                                                                                                                                                                      MD5:DADD037E0FCAF23F1FB8AF021329E6F8
                                                                                                                                                                                                      SHA1:FA4B3498B7FF91AA83036858902470B79ED44B3F
                                                                                                                                                                                                      SHA-256:BA919B0A6784A419D67BE03D57138900416A8F3896F744A8308026F846D8C634
                                                                                                                                                                                                      SHA-512:518B340222FFFF911053313C02A096D162EDA835B76945FA06837DF5C1EE86D783BF8DC83BDF32A521CFFC5AEFEF230A9EA67B33EC98412345F115748BDE5FEF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020010 ..version=1.0.0.1001..name=............[AppSetting]..icon=logo.png..smicon=logo.ico..title=..........url=http://static.apc.360.cn/cms/mini/education.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020010\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                                      Entropy (8bit):6.08454985861445
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:Y96oqv8mYYZ2cbO752hMe5Drzv2nEKZZtP4hbBO+CG50Js0UOX2bEFalXy0rE2GE:AUeYZkwpXzvaJfPOYycs0EVlCBrECc4W
                                                                                                                                                                                                      MD5:1C48CB227F217912E6CCDB2B1D95B9DB
                                                                                                                                                                                                      SHA1:ABD047A0933CFD377F2F16AD2AF9577D53E8CEDA
                                                                                                                                                                                                      SHA-256:48048E284E74ED98B89470BDA05F48CF6618745348D64BE08D7789CF5FC4BEEC
                                                                                                                                                                                                      SHA-512:20209DE59D8233EB200D6D5F479389439185CC70542880BA57BFF289564CF00CB1C9243FCC9AF2F833B0AA2F60F7FD27C967DC72A39AA3E6697E80A1929E1C47
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..............................1a*1...7...7...6...6...8...4...6...8...7...6...9...6...7...7...7...6...7...7...7...7...7...7...7...7...7...6...:....CzZ.........@vIH...J...L...G...G...J...E...G...I...G...E...I...E...G...G...E...F...G...E...E...G...G...G...G...G...D...H...Q....Z...........L.QF...B...9...P...S...R...O...N...N...M...M...M...L...L...L...K...K...K...J...J...J...J...J...K...J...P...@...K....a...........S.`K...9....Yn..p...p!..n...n(..q"..r...t...p'..s...s...q...m...j...k...m...p...p...n"..n"..m'..n...n../.X.T...H...!f...........b.iL...9....PY..\...\...\...Z...^..._..._..._...^...d..%n..(p...j..#l...a...V...Q...R...W...[...Y...Y...W..K...K...%m...........[.wN...9....TW..b...a...d...g...`...^...]...]...^...a...^...f..6|0.].^.l.k._.a.N.R.1x ..g..._...Z...[...^..I...L...)v...........T..P...5....RN..c...^...h..X.Z.g.i.j.j.U.W.c.d.v.x.K.G..k...[...R...R...]...h..7z7.O.M.X.X.U.W.R.P.*s...Z..E...L....|...5h......`..S...4....SG..c...b...[...[...k..3}

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020010\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1741
                                                                                                                                                                                                      Entropy (8bit):7.282943200865706
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:QWHNn2qdIIhEhJ3d5eiPfmu+pYsjpHN8dCw:lt249+8int+pXpHNg
                                                                                                                                                                                                      MD5:A640F4C64FB4808A4DBF2692BC409C42
                                                                                                                                                                                                      SHA1:0B9CF0306C4839FED20F12BA509E265301CECD09
                                                                                                                                                                                                      SHA-256:1C0DFAFD20B039526B3DA6ADB2B3A4D6D79AB5A2E4CBB22ED9692053EA9C789D
                                                                                                                                                                                                      SHA-512:0CD3BF150CC5F45594AEB949218FFF0CBC06D44592FC60A12CB4DEA0C6ED904504E6DE9F8736F91B37029C63F0996AFBDD8E28C853AB3C65350967D9FBAD1D72
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:63D5451FFE5311E1AD2FFA46191422D8" xmpMM:DocumentID="xmp.did:63D54520FE5311E1AD2FFA46191422D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:63D5451DFE5311E1AD2FFA46191422D8" stRef:documentID="xmp.did:63D5451EFE5311E1AD2FFA46191422D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Ots...KIDATx.TS.o.E..fg...Y..7.7..4....P.....Th.p..pAH...w.\..8 ..{B.*.@.....Q.+$i......]..Y.X.ivF....}.^..e.xx...w..Z..Gw.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020022\back.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020022\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                                      Entropy (8bit):4.98799339009139
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:xXsVVLjwVnDFJNNbUQ5ntIEE/MKAX8VXzALysqcs57Jwyn:psVVLkd7Pbd5tIEEMK88FA7srt
                                                                                                                                                                                                      MD5:CF905DAAE5C004070EBD349716ECC479
                                                                                                                                                                                                      SHA1:BC2A567CCE58FD7343441764B023B59D23883997
                                                                                                                                                                                                      SHA-256:74CCD3D8E720295A9BCAA7A8FF292F420629E61D718E7AA258CD5C4B854FF090
                                                                                                                                                                                                      SHA-512:89B9C36165C38230D17BE02D35E9CA208DB8E69835570C91C02913DB402C475034B65EFB0D1993C00429699B2CCE987ABD7BCAF883980146D39E7D928A41710C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[info]..id=41020022 ..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/female.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020022\logo.ico

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 48x48, 32 bits/pixel
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                                      Entropy (8bit):6.528254274979402
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:49hekd/ODFoHCkc+O/8bCyFoO47gojnHKC:4fexKHnO/5yFotkojqC
                                                                                                                                                                                                      MD5:D3BF36DAC2268F5C5EFC74FE319E1A2F
                                                                                                                                                                                                      SHA1:07F3E64272EC80535AD1E8B908396D94FF757C39
                                                                                                                                                                                                      SHA-256:C121021AE242D8128A95C4DDCFA6EA651C6479263D7A4C2E936285C6609D3C45
                                                                                                                                                                                                      SHA-512:7BD42380CA2BED8E9F0FF3E2AC7C6FE3F7981F9CF6C634D5FC5AD4F7263791F96698600D3BF53DE45B4E83B9C1A4522C61173D5DF686E8806F98707BAC60E544
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:...... .... .....6...00.... ..%............ .h....6..(... ...@..... .......................................................................................X. .^.%.c)".\A".Zg&.`.(.c.,.h./.l.1.n.4.p.2.k.5.n.......................................L...Q...V0..YA..VQ..Wg..Y...]...]...\...^. .`.!.c.".e.$.f.'.g.).i.,.k...m.2.p.6.t.:.u.9.u.9.qL......................5%..N...Z...Y...Z...Y...[...]...^...a.".d.$.g.,.m.2.q.3.q.>!x.J-..K-..T6..fG..hF..oM...Z..{U...l..~\..J"..O).,..............#$..J..._..._...[.#.f.C,{.S:..^D..\A..mP..uT..qQ...^...\..{X...a...\..|T...V..{O..zG...G..x8..{;...p...n..._..xW.b..............2...]...`...[.3.o..j...a..}M..tC..s?..t=..n3..h2..g-..a&{.[&t.Y#s.R.l.R.l.Q.k.K.e.J.b.J.a.O.d..H...h...^.................#...@...c...^.&.g......R..K.j.I.h.J.h.Q.p.L.i.M.g.L.h.L.h.O.i.N.g.M.f.P.h.N.f.H.].P.e.['o.S#h.yH...c...a...x..................*...H.#.f..._.`F......p6..I.f.G.c.H.a.I.d.H._.K.b.O.g.R.i.S.h.P.e.O.d.N.b.Q.b.zG...h...o...l...k...c...`...q..................,...J.&.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\41020022\logo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1090
                                                                                                                                                                                                      Entropy (8bit):7.76613347959362
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:/REn/yTUsvAI2o+Zh2w28u6io330GZwL96cDUwhW+89:/+n/Y71+iw2Fo33JZ+Ecowhtu
                                                                                                                                                                                                      MD5:F441D279A97A40FB7DF8353BA76BBD7F
                                                                                                                                                                                                      SHA1:6EB2170AA2A9A989468B969FD78318A9713CD801
                                                                                                                                                                                                      SHA-256:52D4D1D796EB2D4DE9BDA84DE6055CB81B1DA303BC6FCF70D5CEABBAAB716DE0
                                                                                                                                                                                                      SHA-512:88BE0D88F553AECBBC9DCD6276F9063AD913F1237E733C35BC17F5A8C4BC34F4176AC4868E448455ED4D087E13FEB9A2BC92C7E460B86CA164BA3D6DC51807A5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O5S.L.w..M.....C...b.BQA..k.p..CD...t.R.RZ.>....8...XQ!.K.0..-.(...P.Mq...5s1..~.k.K......r9B.`........6.\.O.?..X..'........q[...b.}.Q.}.*../.....*......c..'..!0..g...=h.F........2jN....6..=.>.$tBw8.#sv.x..\.~....H..A....];.....(..~.L..7)..%.N/+...Z.-.r...(......nD~"..s1....eKP,.a.......U.be...9=.....f...x18...Q%.DlH*..Y...4......V...K(...TJX..|....k.......w..@..>.2.r../@.....r.+kqY.j.it...9....8.Yjz....=....{E.........B.j.q.S.N......s.A.g....\........F......... ....(..Ji%..l.:..B....)e.p..Nb."...T.P......$.<-.y. &8..P.....r..........A|H.j$..R{5..;lRe.}.~i5f.Mh..pJP.|.Q.y.Q.P.....[o.8O.............@...."s..m..0.7....>....MY.b@{.....d.p%....v..}.r.....\.q..._4.K.-8.~a.........QH...O..\+....#..`.j...'.'.....uA........RB.%...\..!.=.<Z8.>|t..a.G..4....n..6p.F|.p*....}.@..@.w........D(.<.=c........U0.i..s.0.G..!.........m].........~..E.u..A.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\MsgBox.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):510696
                                                                                                                                                                                                      Entropy (8bit):6.459926518380195
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:Kb+/Ln26GlBvxG4stUgGC9PkPCEFnKowWTa6Gh:n2HBor9PkPCEko7Ta1
                                                                                                                                                                                                      MD5:486C38F163027600AB117D4D1BA6F254
                                                                                                                                                                                                      SHA1:14997ABF08A3D2711209FC617D2AE91033AD8BDF
                                                                                                                                                                                                      SHA-256:0F7DDE159F497F194267B1400C05DD9304805B6B6AEE2A923F86C6854C38C65D
                                                                                                                                                                                                      SHA-512:65CD19982B9EAD7FEE58414B48D24F5BB99FDCA882E20A396153CA7BB10FA2F9FF15B6C97634EDB29E0AE5F926C5044382C8C45288E2520ADAF2F004C6DB5F2F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z.Q.z...z.Q.z...z.Q.z...z...z..z..Jz...z..\z)..z..[z...z..[z...z..Uz...z..Mz...z..Kz...z..Nz...zRich...z........PE..L....P.O...........!.....F...d......v/.......`......................................._....@............................m........... ..<>...................`..XU...f..............................h...@............`......<...@....................text....E.......F.................. ..`.rdata..MO...`...P...J..............@..@.data....j..........................@....rsrc...<>... ...@..................@..@.reloc..(....`......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\MusicIEFrame.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):584000
                                                                                                                                                                                                      Entropy (8bit):6.594932333601168
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:JGonh08rgTC/lBz7ZJJU6O0ksHXZwf5kbtwd3pMg0JeFR9Pz:JGcvroC1JJg0H3GYtwzT9L
                                                                                                                                                                                                      MD5:45DB84CAC7279600FFE76EA7DEF6839D
                                                                                                                                                                                                      SHA1:0FB498863ED8E0DCDD495D2171BB950CE6C614E2
                                                                                                                                                                                                      SHA-256:82E0C1FF9D3E88715D36B2E05E66360434C7D0AF0F8CB28E299E156544093B5C
                                                                                                                                                                                                      SHA-512:392ABF8B63E71DA621408A195CF21959D29521B8AF1F71521B06D4B89EF4A9562184F515FFA12C4AA46B8860DC9015C801042EBAC4204858FC2C64C433982052
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i@N.............p.......p........C.......U......./......p.......p.......Z.......p......Rich............PE..L...].[Q.................&...................@....@.......................... .......~....@..........................................`...w..............@.......t;...D..................................@............@..8............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data...$N....... ..................@....rsrc....w...`...x..................@..@.reloc...=.......>..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\NotifyDown.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\0.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4502
                                                                                                                                                                                                      Entropy (8bit):7.913847232220015
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwn/ea+W+62BxX07:/ShuweflgTMEEO0nKZ1R8ehBxk7
                                                                                                                                                                                                      MD5:03443B5ED06C4C0578E49FA140B1C6AE
                                                                                                                                                                                                      SHA1:0BCE94FA69102EA0CCDA90E42EFA4C070895426F
                                                                                                                                                                                                      SHA-256:A3AB9D0CC16B534EEE0ED9074CF0001EC13C47FAFB2ABE5A77C410DBF38ADC7A
                                                                                                                                                                                                      SHA-512:9E557DF066DD9B8285A141EEB483783C649E425A088495BC2DB9B2EB18AD1141F98F71EE049196FCBBA1428573938D9F020358D504A1C08EDD044DBBE614D867
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\1.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4720
                                                                                                                                                                                                      Entropy (8bit):7.910929199552645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwQ9IYDFUcX/Il1TXQNtWoH:/ShuweflgTMEEO0nKZ1Rf9IYD+I/O1Ta
                                                                                                                                                                                                      MD5:82C2A66ACA005AE47EFA6CE326ABFE76
                                                                                                                                                                                                      SHA1:1009671F3A2397528232F773590F251B1361567A
                                                                                                                                                                                                      SHA-256:A78939D1E1822D661C18905BF4FF002B069FEEB9E2B61443D6F8BED68F4BD3D3
                                                                                                                                                                                                      SHA-512:1E66793FEF142158EE9F767BBE66D3020A200113644D76A3E9F0BD0A07A19D0A645870F911B1A19086F7474043A1A04F17812CF76F4C7B5FD9EBF996E0967599
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\2.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4745
                                                                                                                                                                                                      Entropy (8bit):7.906551448003165
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwA9EHczkCM5yRyM0ADjr5:/ShuweflgTMEEO0nKZ1R56HfCDRyzA3N
                                                                                                                                                                                                      MD5:C948EB58717C808198DCB2253535C068
                                                                                                                                                                                                      SHA1:1E9FA3456ED43BC6F1688D38B44F28C5BB79F76E
                                                                                                                                                                                                      SHA-256:D78BD49006A2AAD356F7C043593256241A4FC2A7E63890002BA840BAA1027BBB
                                                                                                                                                                                                      SHA-512:E2748AA2D7EB462FB9B21E408A479B993A52B5DA8499BAAD6686F8DEF0FE7AB53B1D7AD686BA7174E85A2C08F64D1C52D4518443849209BB940C943F1796E506
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\3.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4784
                                                                                                                                                                                                      Entropy (8bit):7.91968879390982
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwnhfMROht+7hLUBvVqOmEw0K:/ShuweflgTMEEO0nKZ1RkhghgQw5K
                                                                                                                                                                                                      MD5:6FAD4397D817D28386B5888AF6E596F2
                                                                                                                                                                                                      SHA1:7922E4782457C1478D85B14D5DD44F3420A16076
                                                                                                                                                                                                      SHA-256:59394F229FD727EE54E4A93FC607249FB79C4E1CED49CD55C5F36D07D9F493F7
                                                                                                                                                                                                      SHA-512:70AC2D8BE829BB7B021211F83E71E3C1B546C8A9DA72A0F323ACFA6E8884D72AA64C097A2B95FBD7E0D133D0BC48E73F69D95B956C2DC616454083633FCB7994
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\4.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4833
                                                                                                                                                                                                      Entropy (8bit):7.915121783505522
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwY+6DKmz4RH7/QUBCx18Oi6O/t7Ie:/ShuweflgTMEEO0nKZ1Rf1uFH7/Q2C3e
                                                                                                                                                                                                      MD5:D9BA67EF6CFEAD7F1A62E579904241F9
                                                                                                                                                                                                      SHA1:98C13A03B56900C28E4DB7DB13A807D15F7B0AA6
                                                                                                                                                                                                      SHA-256:80199A066CB6E29A4131F034E92A22F687E097554FCD15D0497B6553BA04EB28
                                                                                                                                                                                                      SHA-512:434D4617638ACDD0A505A6F47613632FA7846F5857B554399393D716BE43F741A08C36E40219755A21A5764CB4348093BF6184B492A4445E5804C10DCB4CE2A5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\5.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4490
                                                                                                                                                                                                      Entropy (8bit):7.914756290833229
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwB+/ZRK0UhYQ12wau1:/ShuweflgTMEEO0nKZ1RI+T0x2wp1
                                                                                                                                                                                                      MD5:F8D45187D602D6B6BA49A4460695EA55
                                                                                                                                                                                                      SHA1:DFDB711F7E5AEEA31D41639E0477F4A7DFAFC0A1
                                                                                                                                                                                                      SHA-256:140347F6A1F50B6827359EF961F31CF7F7FB2B800FD730C21AAB437FB1EB4905
                                                                                                                                                                                                      SHA-512:E1382EAF8A4BBE93A48AAB86E3765133AD841CDB74D2C7B78B053DB9CECEDAF41E0425FE9695A1B1CBB386321B4BE919FB94603988D7658806ADFA7FC0B7121E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\6.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4628
                                                                                                                                                                                                      Entropy (8bit):7.9134281959066355
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw7DTfI/ya4WfUiW0B042od8:/ShuweflgTMEEO0nKZ1RIDSxfUiHB04k
                                                                                                                                                                                                      MD5:6EE23E80FDF87305D823AF28A755F479
                                                                                                                                                                                                      SHA1:F1F5AEB82A11407B46EF88171B0CE6E32BA33515
                                                                                                                                                                                                      SHA-256:B22B3DBE0B1EE0865A44343C598042E29B05A63E4647454ABE288F3612B1BF00
                                                                                                                                                                                                      SHA-512:FF2CCC273A063BF4D3F302FDC8384D63035EE8F071DCBEAD710CC94C173764B331ED26C356E5BF688B7761555CDB263405F2B88F6748D4A70CC380701A868C5A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\7.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4450
                                                                                                                                                                                                      Entropy (8bit):7.908145383039164
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwmWJ8muaMMYpnUF7WavfP:/ShuweflgTMEEO0nKZ1R2Jx/Mq7WEfP
                                                                                                                                                                                                      MD5:714DA01FA83B494EBFC4B0431A435578
                                                                                                                                                                                                      SHA1:A03B48EED86BEED3302D638967C2321532A4786E
                                                                                                                                                                                                      SHA-256:BC7A1749B485C7DD596E47AD2C333AFD4C618D4BCB6AC778AD22D2021CD5DE81
                                                                                                                                                                                                      SHA-512:1BE5417627205B56365963C6987E1AB0DC2E7EB8FAC2216491A4ED0FA77C354C7017CA80C0F75106EAAB9C27BC836DCF6BC72BCAD4DCE91D0D21835F348B3E48
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\8.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4500
                                                                                                                                                                                                      Entropy (8bit):7.917985621284803
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwWa8zQiPJUBoMdpWAc0m:/ShuweflgTMEEO0nKZ1RK3mUBoOBm
                                                                                                                                                                                                      MD5:A1D584A6F5E61C876A18AB41838167E3
                                                                                                                                                                                                      SHA1:32338EC7EE370EEAC323D7F4E08445B0E034F083
                                                                                                                                                                                                      SHA-256:2F818AD9FA9E8022846E67E1B7D3B63530FB7CD5AEAA82FF6331679D11EF40EA
                                                                                                                                                                                                      SHA-512:017B8CEC7199EABA9D2AA1D8442AEAFD134E4C461DCE436D71D92AA2017E7ACCFDDE325DF8F3876F65BBD64D86A910766886698415A0A04D1D6CCEE416270672
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\9.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4252
                                                                                                                                                                                                      Entropy (8bit):7.914745740309695
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw8ahU0JOI/nfAMB:/ShuweflgTMEEO0nKZ1RKU00IQM
                                                                                                                                                                                                      MD5:C49CA4AF0CD038C8E94AE523BAF96AA3
                                                                                                                                                                                                      SHA1:6A5DB9C4D78D1ADE228D589402669CA798F49055
                                                                                                                                                                                                      SHA-256:C6CD29C7CA458D53F98E05531EE0DB54162A07676A93EB7ABAD5DD612AE262D6
                                                                                                                                                                                                      SHA-512:04FD518735E92B4B495A0B3402477E31C25A414B96E32923280E1CC4B9A7758A19ABF3C9453D63F7E1976B9D4F9F9195E9ADD5D8CBB0239EE3F0B4791B2F93C8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\PswImg\PswImg.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):150
                                                                                                                                                                                                      Entropy (8bit):4.496733935873367
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:QA/oeLl5VgC6fU/ubC6hNvJPhiM9TERQIC6IgBEoAovM4KgxeJvn:QoLl5kkubC+BHsQICfEEdHpoeh
                                                                                                                                                                                                      MD5:F381D25EDE8E75B43B15812D34639F31
                                                                                                                                                                                                      SHA1:4737138A26DFAC9A951EAA61284C474BF9E91D33
                                                                                                                                                                                                      SHA-256:2CD7942D3CC2E3B374AADFCF8845546680B4DBC7CD49D939C9B8FDF1E30F92A6
                                                                                                                                                                                                      SHA-512:402A706B8A885EACAD5F704028CC7CE38EA982F25FC03F557AFBCC0416CED2A1796501FC80BC337161DCFE4C692E19667010E820FDEA1D336F91D3D08E371E91
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[images]..count=10..img_0=apple..img_1=banana..img_2=orange..img_3=pear..img_4=tomato..img_5=beef..img_6=noodle..img_7=rice..img_8=fish..img_9=pizza..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\RegSMWebProxy.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):94360
                                                                                                                                                                                                      Entropy (8bit):6.439301229562193
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:EBw4ZQDGLJpVScRDdF26vamLBOgm0j4kLcq+UL1nINzs5FKSXssRwCaM:lVDGL4MRTLp91VQs5FKS8vM
                                                                                                                                                                                                      MD5:65CBBA195B71603A4FFB7F7F85CB100D
                                                                                                                                                                                                      SHA1:867AEF9332BEDB8A226EA43B711F7C39B77E55D3
                                                                                                                                                                                                      SHA-256:9A95725D30B843B195EAF7848B5A1F45F9542C3607F1F394EFC00840D1D2D61A
                                                                                                                                                                                                      SHA-512:7A539AAA037B05B960918B635D19AF4538468B280AFDEA747AED9E3E7A9EAD71C44DB2C594C9C91D2703F85969A86D3D654C5AC93A117E873C1C7BB093A253D3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..J?.u.?.u.?.u.6...,.u.6...S.u.6.....u.....4.u.?.t.L.u.6...5.u.!...>.u.6...>.u.Rich?.u.........................PE..L....q.O.....................t......QD............@.................................S.....@.....................................x....p...............T..................................................@............................................text............................... ..`.rdata...5.......6..................@..@.data...|=...0... ..................@....rsrc........p.......6..............@..@.reloc...............<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\RegularShutdown.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):478584
                                                                                                                                                                                                      Entropy (8bit):6.539196463495275
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:5BcE3okNxTv2eMwmQNSrv4t3VNZ7G039tS7:5XTMqtFf39tS7
                                                                                                                                                                                                      MD5:F6558ABE236AC14E95A2CC9E8016F10C
                                                                                                                                                                                                      SHA1:422F19A783888188FA4E893BDFC4F49F8153BDDF
                                                                                                                                                                                                      SHA-256:353FEF1191DE8CCE7F9D65C221BB6545AAAD188F29C377CAB7A71BB6E6DF2905
                                                                                                                                                                                                      SHA-512:14C3679BB468300867CF8B07558BDD2CA31CB0FD5508C61B2BBDC5C4E8C447F82CCCA80B0C87A1D551C161E2187663DB698A7DCC9BE3F56603B260B43B631F1F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_.._.._d.M_.._..N_..._..X_l.._..__..._.H._.._.._.._..Q_.._..I_.._..O_.._..J_.._Rich.._........PE..L...l.(P...........!................^.....................................................@.........................P.......|........................8..x.......LI..................................X:..@............................................text.............................. ..`.rdata..............................@..@.data....O.......0..................@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SMWebProxydt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):192888
                                                                                                                                                                                                      Entropy (8bit):6.456073453336491
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:fVL+cTZub2RsvU8r9sa4/xzzwZ+jVdcAnqC790CN9rv+2YfyAI5/Tqig0X:fTO2orY/xzkSTbnqDOlX
                                                                                                                                                                                                      MD5:7520A23D749D16BB35C00B866A875E4D
                                                                                                                                                                                                      SHA1:3CF93090606C7F904DCA566B6E63496CE4A9462F
                                                                                                                                                                                                      SHA-256:C5544BFF662C1C45E32DFC774A9CAEA117B3FFD9232738150319A43BBBFC4E1E
                                                                                                                                                                                                      SHA-512:811FDCF2D28330B1FB7D8EB961972EC3302AB4A3BBAE1B8488C86A72CE0820BD057CF64EECA9B208F9D263BBD883D3B91F676AB81AD247DCA031B7B15179D133
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a..Xa..Xa..Xh..Xj..Xh..Xx..XF[.Xb..XF[.Xv..Xa..X..Xh..X1..Xh..X.Xh..X`..X...X`..Xh..X`..XRicha..X................PE..L....`<P...........!................-........................................ ......l.....@.........................`m......@^..........T...............x.......\... ................................@..@............................................text............................... ..`.rdata..N^.......`..................@..@.data...|L...p...,...b..............@....rsrc...T...........................@..@.reloc...4.......6..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SetupUtilDT.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):170344
                                                                                                                                                                                                      Entropy (8bit):6.515376474233682
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:X8cE5RULjRoG6LVI4P7+lLdoL6qY0foiStJv5LULIebzLo:Xb0RUfaGiI4P7+lLKmswRPtlG/o
                                                                                                                                                                                                      MD5:301A4BCA1A602AAD88C5E21AE2A8322A
                                                                                                                                                                                                      SHA1:73AEAF28C654C8AE61BABD5681160783520F5963
                                                                                                                                                                                                      SHA-256:977B181508CDE3EFFDE19A22B03127626AF6D96B6ED0B29B7AFB514B1646672E
                                                                                                                                                                                                      SHA-512:0A00B9274485FC4CA8EBA9BA90161AEC950034804076C79E4DE7DF76E971FFF179349E4BF6F72EF4F53D357E2D5D19584B7322C9C8D2DD1DE55BF2F1FBE22209
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eqz.!..L!..L!..L._.L ..L(h.L6..L(h.L...L(h.L...L..oL6..L!..L...L(h.L0..L?B.L ..L(h.L ..LRich!..L........PE..L...R;.Q............................=.............@.................................u`....@.................................LE..........................h...........................................H1..@...............<............................text............................... ..`.rdata...R.......T..................@..@.data....3...`.......D..............@....rsrc................Z..............@..@.reloc...$.......&...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Shell360dt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):143680
                                                                                                                                                                                                      Entropy (8bit):6.431961396973279
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:DO/okRPCVM811+40nXrTwSmyOv54lJ1b92q/5l:DO/ouPYM81QnXrTxldL
                                                                                                                                                                                                      MD5:2886F9660FC089ABA2443F39D17325E9
                                                                                                                                                                                                      SHA1:152EAD0B9248BD91A2AD5859F66A61D8F80C42F3
                                                                                                                                                                                                      SHA-256:CD72A2A410DDD4F9EF32A191B1E7C95833DCEC2547F559CA0BA86B81F25183EC
                                                                                                                                                                                                      SHA-512:B1DBF94CCA19477D86FC1489311A524C8B21629BA38B13531D2560E5ED54CC9946336E63C424E03B2AF4E12E77BB8E333BBE4123738E660771BB44E092074A1F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...-.=.5....V.'....V.1...$.......-.,.d...-.+._...-.:.%...:.<.%...-.9.%...Rich$...........................PE..L.....Q...........!.....\...................................................p......s.....@.............................3............ ..................@....@......................................P...@...............t............................text....X.......Z.................. ..`.orpc...3....p.......^.............. ..`.rdata...U.......V...`..............@..@.data....3..........................@....rsrc........ ......................@..@.reloc...$...@...&..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\Shell360dt64.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):173680
                                                                                                                                                                                                      Entropy (8bit):6.219447336142119
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:Ohklszuf0QeZ7Gf+oCKcGs2U80sWLGk+tg7r9yku5M2Tyl+l3:Mgsaf0xx7obcGsRd6kugfW2G
                                                                                                                                                                                                      MD5:3A3848AB6721964EA1A2234295A95A53
                                                                                                                                                                                                      SHA1:4615743A3085D28D3C90BA3B45C2EC35CF6EA512
                                                                                                                                                                                                      SHA-256:90DAAB3EC9710B8CCACE6C5AE78F4ADC593DADB409115A59C0A2355E5ED3DCE5
                                                                                                                                                                                                      SHA-512:E3D208F04ADB96B0E6938284C20D196BDEF3F44AB8B7F0E9882A70FBA71F333A3C45A7E801B3F7B1DB38BCF1EDC1090F58227F26042A4FC15AC9CA7D54EA54C6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E>..._w.._w.._w..'.._w.&...._w.&...._w.._v.._w..'.@_w..'..v_w..'.._w....._w..'.._w.Rich._w.................PE..d...l.Q.........." ................................................................0.....@.........................................05..4....$.......................p..p6...........................................................................................text.............................. ..`.orpc...5........................... ..`.rdata..d...........................@..@.data....@...@......................@....pdata..............................@..@.rsrc................J..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SoftMgrLiteBase.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):224768
                                                                                                                                                                                                      Entropy (8bit):6.287026084352163
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:AGD6qutYgGVwas4sY1qvp+bGotGedb1YZI/sN1uxC+pl5eP:iqut4eazsY1G+bGoYMbiZI/sv0SP
                                                                                                                                                                                                      MD5:29BDF546B35C9348B0548697EB514AD1
                                                                                                                                                                                                      SHA1:FFD42914C242016313413F8F21E96DB6B2F7D53B
                                                                                                                                                                                                      SHA-256:A081598EB62B3339C9F548AE7EF4E1119A6CE25ACDC2CC7E1C93282E0B10FB18
                                                                                                                                                                                                      SHA-512:C8FADEBDFC24D14FC997D75105BFB8389DD04C080D7024C862F8927A3D718DAA6C543C4220FAB01EE68911A7E16E4535074D7BDF0E4053A57D7B563718ACDEB3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:...:...:.......;...3...(...3...|...3.......3...5...:.......3...7...3...;...$...;...3...;...Rich:...........................PE..L......P...........!......................................................................@......................... ...x............`...............V.......p..\.......................................@............................................text............................... ..`.rdata...^.......`..................@..@.data....>... ......................@....rsrc........`....... ..............@..@.reloc.../...p...0...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SomSoftMgrdt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):313208
                                                                                                                                                                                                      Entropy (8bit):6.466680083448089
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:yk6s0aqVh3w17APg2/9Zdq3wExVa3gc7wN+0/8cXtnhCK:yk6s0aqXw10Pg2/9AR+3gc7wkNc1hCK
                                                                                                                                                                                                      MD5:98F5B324441C8C5B05CF3B2A16F9320D
                                                                                                                                                                                                      SHA1:731BB8172FED108D6CB4593CA099E252F531113A
                                                                                                                                                                                                      SHA-256:5CEC3C7FBFBFBA930F2B8E5FBC50E0405538CC8A5A71F61B20F769268B6C968B
                                                                                                                                                                                                      SHA-512:E3B04CB980393E0F87C2688AA1158383785E08D286F6355C82568FD4031C5051D1B2D531DE0D428F4F3E0CDEF6E5084128668ADE27DA6120FC4458141777F605
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n...*z..*z..*z..#.:.<z..#.,..z..#.+..z......%z..*z...z..#.%.%z..#.=.+z..4(;.+z..#.>.+z..Rich*z..........................PE..L...S`<P...........!................................................................=/....@......................... d..I...dY..........................x.......$%..p...............................P...@............................................text...2........................... ..`.rdata..i...........................@..@.data...XD...p...(...L..............@....rsrc................t..............@..@.reloc...7.......8...z..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\TopBar.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiFeature360Control.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):452272
                                                                                                                                                                                                      Entropy (8bit):6.546876372610879
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:CIx7/JbPCSozzrRM96+V5/sXNsCyBq7FnBvSfSEBoeUICKZMeXGMIrqj5qrf:CIx7/8rnC96s/U97VBvS6EBgInmeXGMf
                                                                                                                                                                                                      MD5:88DA47DCE2422F5CA1EA8CCAF94B0CD4
                                                                                                                                                                                                      SHA1:EC6E45CBB75E468F421AE51378705A1177FB232D
                                                                                                                                                                                                      SHA-256:C0443A671EE72A09FC18942D77A34EBA73A8FE7619144756C9AB019244F24FFE
                                                                                                                                                                                                      SHA-512:631AD4A19B70D5F02E53D63134DE901C0565EBBC47DA3B9B9492A6C1A0548B7311411CBFD668CB5929C7D33D53A1893AA5D1EAE1DEFA0AEA1ECF51177DB1E489
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}t..............d.......d..}....d........w.......a..............d......d.......N.......d......Rich............................PE..L...GYRQ...........!.........................0............................... .......v....@.........................@G..\....7...................................G..@3..................................@............0...............................text...~........................... ..`.rdata.......0......................@..@.data....@...P...$...4..............@....rsrc................X..............@..@.reloc..pm.......n...^..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiFeatureKernel.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):339632
                                                                                                                                                                                                      Entropy (8bit):6.596958488639138
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:bSMhbBN0RPgKmQs1wOWTxApJyL1l6niUG+VbNkrk908OI8a+gKeSjt5rPxrCmEaj:bSMhNWRPglwVTxAQ1l6niUG+Vb6rk90P
                                                                                                                                                                                                      MD5:7BC5C0F13A513D3C14432C20DCBFBC6F
                                                                                                                                                                                                      SHA1:086A8E486DC1816C07C2F59015BC7F61408C19BE
                                                                                                                                                                                                      SHA-256:18E443B2582C0B04C92A3A9856F339AC8105AC5F31ACBFAADCA18E9FB74C08E0
                                                                                                                                                                                                      SHA-512:F60CD9D94BD94B740379C0C9736E98048449793894633C13CE39EC4981476ABE9AE239663941844141B2171C30EED0CB350893A82C7B87ABC85C7F7098E3119E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.O.).O.).O.)...N.).F...X.).F.....).h.G.N.).F...y.).h.D.N.).h.R.^.).O.(..).F...{.).F...N.).Q...N.).F...N.).RichO.).........................PE..L.../wQQ...........!.........*......t........................................p.......0....@.........................p...[...l................................ ...+...................................r..@...............<............................text............................... ..`.rdata..............................@..@.data....;..........................@....rsrc...............................@..@.reloc..vA... ...B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiPluginCake.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):113840
                                                                                                                                                                                                      Entropy (8bit):6.4167169275089755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:C7gXG24dB7sp1yJP0HwAr8QWTiRIx6PFt2vfpmwXsiDcpBm6jdS53gCUz:CyG24r7sp171m9xut2vfpyJ86ZS53/U
                                                                                                                                                                                                      MD5:A609343C55A99F18637A839C747B5100
                                                                                                                                                                                                      SHA1:93EE2A5E2AC2E8F5EFDD81E3D20C0EED9789D759
                                                                                                                                                                                                      SHA-256:436EDC59FADFE1E79D1298C4279B01AB78D05A90AA8994D18DAE9947F74E63F0
                                                                                                                                                                                                      SHA-512:9ABF899138248B381F82AF9DF1A16223B7270201D28427B1F8F065DDCFD7F2E5362C7E6768D7B1019BBFAB0263053910D2AD7A4ABDEB8044FD39EEC2D65D3A12
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sk...........j.....j......j......h.....~.......n...j.....j.....@.....j.....Rich....................PE..L...'H.Q...........!.................s.......0............................................@.........................`t..~...lh......................................p2...............................U..@............0..$............................text............................... ..`.rdata...D...0...F..................@..@.data....0...........d..............@....rsrc................x..............@..@.reloc...".......$...~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UpdateTool.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):104904
                                                                                                                                                                                                      Entropy (8bit):6.415069485363196
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:IhlPjE30TlqLk62khxYOR8HIfsgjy8Lw1MACpfKT6FTS5iMVnwCaR:IhBjJlqLl49GpjHLwEfjFTS5i2nuR
                                                                                                                                                                                                      MD5:9882B5CB410EAD9CBF994D3473E042F9
                                                                                                                                                                                                      SHA1:C20212130A3A209104D8E7031ED8108E42D56C1E
                                                                                                                                                                                                      SHA-256:170B0F6255D1F3B4A8512353ABAA59D2B89D95D282F630782D7AD1721C849A66
                                                                                                                                                                                                      SHA-512:A0815915D407C46115719CD5D3B569E5F8D26FCC8BF46339C830E24242291BB961012A24221E08937D1AEA434BF4D17B13EA5E75693F657FE2B396AC5B165FD3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............g`\.g`\.g`\...\.g`\...\.g`\...\.g`\..\.g`\.ga\.g`\...\.g`\.5.\.g`\...\.g`\Rich.g`\................PE..L...}..P.....................|.......n....... ....@..................................S....@.................................xO..d...............................p....!...............................@..@............ ..t............................text...c........................... ..`.rdata...7... ...8..................@..@.data...`>...`..."...>..............@....rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\addapp.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):682
                                                                                                                                                                                                      Entropy (8bit):4.909863438974874
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:7WWZowjIzisjIXyjIirbHToONjoOiONsW6Yo6suXmMjIQ60TO7KwhoA+EoMOb:7WSj6isjRjTrbzoONjoFPlYoHDMjpFx5
                                                                                                                                                                                                      MD5:8BFE9D0B36CB07F1EFD8EF5447120ED5
                                                                                                                                                                                                      SHA1:304077E511928CC7F35D9B20E5C76F4FDDBFF64E
                                                                                                                                                                                                      SHA-256:BB8611D4C1CDD69DD0024768A782D4FAF9D40357EBF5415B4D92F7676EF8CABD
                                                                                                                                                                                                      SHA-512:501B6B3B7502F7FB47B7649580F313D20E4D0C1D1E38701E2CB16C0059C0C595820D95FD7C46DFE79F1C424E7614CCD3599BE9FE0478F96B3755A5E448897305
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<script>...function Addto360Desktop()...{....var title = window.external.menuArguments.document.title;........var url = window.external.menuArguments.document.URL;....var parent = window.external.menuArguments.window.parent;....while (parent != null)....{.....try.....{......var uu = parent.document.URL;......if (uu == url)......{.......break;......}........parent = parent.parent;......url = uu;.......}.....catch (err).....{......break;.....}....}......if (url == null)....{.....url = window.external.menuArguments.location;.......}......var obj = new ActiveXObject("DesktopMeunObject.DesktopMeunObject");....obj.Addto360Desktop(title, url);...}.....Addto360Desktop();..</script>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\apppages\bg.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe ImageReady], baseline, precision 8, 682x370, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):34299
                                                                                                                                                                                                      Entropy (8bit):7.886401642174046
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:49GOMIVwO5aeCKHpstGctFhM0IkE3ountxkOu3miS+PE2FA0ETeBm:4kIVNMoHpsgc7esS1noOuWi9E2K0Ef
                                                                                                                                                                                                      MD5:B550092E07391F8185F571A9FA468123
                                                                                                                                                                                                      SHA1:E46E480DBD44D633D9F3208D2082EF5996102B98
                                                                                                                                                                                                      SHA-256:BC079E3B3307D409A37B511DB9DDA0BC7C37847A4D1D370B33B7926068D2EE19
                                                                                                                                                                                                      SHA-512:375640C3656B7FCD1225DD5D15415642D1541B136A9190B83B32D8542B942BB0083AFDEB8A11AFD4DF81FEE09821990976866B17B2658DFCDE3B121D2C027536
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`.....XExif..MM.*.......1.........>Q...........Q...........Q...............Adobe ImageReady.....C....................................................................C.......................................................................r...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....p..-....R..P...as.......)..iw....)3.z...Aa@.T.J.b......Q.H.....R...{.......ri. w....o.._.c....@..U....2*;K...J.......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\apppages\img\body.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2012:12:07 10:58:08], baseline, precision 8, 1300x900, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):38959
                                                                                                                                                                                                      Entropy (8bit):5.853823250628968
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:XjgIrjnsIrjn3U5TtE62Eop6tToxVWB0MPrEW2sfjPqxIbIrvBU:XjgIr7sIr73wtE62p6oFMDEW2szbcvK
                                                                                                                                                                                                      MD5:D09B2C3955C3CADBC31B1E4A6523C188
                                                                                                                                                                                                      SHA1:BF142841A6E5B45943D1C74431A349988D8858BC
                                                                                                                                                                                                      SHA-256:4F4C74A700CBAAB12B3664F3824E5B681F7929E4DAC2714F497D6C318A309D9B
                                                                                                                                                                                                      SHA-512:56C5474513B05F73AE514BAAC38EAF02A8ED94C406EF4E0A5B036E36080D210CF94C44076F35A235D71E77CBC9C11F900CFF71E31DA805CA2B4C5F435BB397DA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..II*...........................b...........j...(...........1.......r...2...........i....................'.......'..Adobe Photoshop CS2 Windows.2012:12:07 10:58:08.................................................................................&...(.......................................H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................o...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..RI%..$.IJI$.$.BxN..j......Q...&...C.1j6...+.....THF..$.&Ej.I$...I%?...RI%..$..&~I)p....h..........D..&.V.E".....HV....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\apppages\img\loading.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 420 x 18, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1909
                                                                                                                                                                                                      Entropy (8bit):7.234982063350527
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:PCCRgnxwhC+1SOLzA5+MTFC+M/BA6AlIxrYzI:KoyS8Og5rTA+BlCrYU
                                                                                                                                                                                                      MD5:9DA3F1D059FECE8DDB1F6EDF43AC2363
                                                                                                                                                                                                      SHA1:DB62DC742686C128F461938287DA27E4C522B1BF
                                                                                                                                                                                                      SHA-256:E923BC0678176F9847AAFF4AC59E9F7C39780469BA29F6BAA481BA99312EF7AC
                                                                                                                                                                                                      SHA-512:AA0DD1E1677D37386FD998676747D445D62DA8DF8A05B01A62FA5FE8D895EB428C473499C043957497AE7CAB63D6524A93B18ABDB900813355DD13D484BFC6F2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............#vZ.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEp.....t..............l..|..c..L..Z.....R..E..J..z..i..G..r..`....Q...S..Y..V..O..T..d.....M....ou.._..f..a.....G..{..{.....b........L..H..b..R..M..N..W..S..p..Z..l..t.......aZ..a..Q.....X..N..M....#M..s....mk..Y..i.....a..Y.......iZ..k.....r..R..V..s..s..o..Y..s..j.....s..z..S..c....t..X...H.......YS..F..^..I.....S..c..P..T..H..[.....w..R..P..L.....|..K..H..K..M..M..Z....hN.....l..]..R.....Z..R..S..S.....L..../Z..m..r..s..I....qL..N..a..Y....6R..r..Z....+{.....W..j....{O..l..^..`..|..g..M..j....JK.....W..v..t..d..O..J.......E...)i.h.._..L..p..J.....t..$j.`..b..f..L..^..e.v..6-p.[..a..:w.F.4a..,r.'n...26}.>.m$k......g~..]..6|.@.o..QR.3j..J....Zd..U.1%l.e..k....*2u.F..x..-s.M..G.%.....(...3.lc..'o......=..T..x..3t...t_.....|:F.....tRNS..................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\apppages\intalltempapp.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):519
                                                                                                                                                                                                      Entropy (8bit):5.160278137718593
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPgGxC7/mjWsVnqJmxTTqK5eQE8OYMCcfxqc2OAqUKCGb:hPrC1sV8IfvEYMCo9z
                                                                                                                                                                                                      MD5:B00593D03F76B157C02A72A9F132405A
                                                                                                                                                                                                      SHA1:FCE91F62543C4104BB906F3A83F6DEB7DEC0F5BB
                                                                                                                                                                                                      SHA-256:825D1318B7463FD5F670958C5E7BEC7D609340661EAD84ABB4F2E68FF987498B
                                                                                                                                                                                                      SHA-512:A33793891F05D7610FAD9D5B6F1EBCB4799871BE6F00C964E1390F36421085DC04DD1AE2C7BBB219FABBAB2FA94EAB2E923B491C81871A06EEA33EB639CBF2C7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..function changeProgress(value){...$(".in").css("width",value+"%");...$(".percent").html(value+"%");..}..</script>..</head>....<body>....<div class="box">...<div class="loading"><div class="in" style="width:0%;"></div></div>...<p class="percent">0%</p>..</div>....</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\apppages\style.css

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1657
                                                                                                                                                                                                      Entropy (8bit):5.247663084618733
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZICveGXqPF+9jJ1exEU+vZYNo+g8HVACmFnRlxnMXUbF:WJ1h+/RV++MZMrA9lxnMXaF
                                                                                                                                                                                                      MD5:7E0FB59D3AF2D442F44A939362311DD0
                                                                                                                                                                                                      SHA1:3F1FD2C2B9DDC773B6972F767BD321F353C6066F
                                                                                                                                                                                                      SHA-256:DF9459349CCB55416078BA535A17AE8587BF321049F4D0A5AF460879B62B4699
                                                                                                                                                                                                      SHA-512:03D0D5D69C38A7E1F75D39A31E9C597B862F9D1BEDFA14C4CB8FD37EFE5800FF01F97A917A8ABDE8C33E98A87436101D183250D101E5BB85B1686A1F3B3B7935
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...t-a-l{text-align:left;}...t-a-c{text-align:center;}...t-a-r{te

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\deskrule.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\desktoptool.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):815976
                                                                                                                                                                                                      Entropy (8bit):6.583545883404885
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:CHdnaQERSfWMwBsidpIitSeVkud0KWrQF8:QZXPudnWkF8
                                                                                                                                                                                                      MD5:5CFAE5D76DED38E1CB816B78D8E66D2C
                                                                                                                                                                                                      SHA1:924700D0891FCCA309EF6FBDA1877A82073FC68B
                                                                                                                                                                                                      SHA-256:B7F777BF003E3EEFFC846E483FAA6C435AD1266560BEAC4D51A95703AC12D701
                                                                                                                                                                                                      SHA-512:DDC75AEA59D9500E7BA8A4E592412752946935B518C90C3D2237422E12AF5790448918C6C938764EDAC39C98A65FD80C6DA7E8C2B4CD8047EB26B775F1476DFB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..eR..eR..eR.U*...eR......eR..7...eR.....eR.....FeR..?..eR..)..eR..eS.`dR.....eR..7...eR......eR.Rich.eR.........................PE..L....x.P.....................H......m>.......0....@.......................................@..................................l..,.... ...............`..h....@..ln...6..................................@............0...............................text...P........................... ..`.rdata...Z...0...\..................@..@.data............:...t..............@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtappcore.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):331440
                                                                                                                                                                                                      Entropy (8bit):6.5814193529642795
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:kzs3sd6FY2zMINPNwB7Ki21uEodEsi9x2lEcJAxcvyXAO8+/ylz:Ks3sdsY2PiBFxREsi9x27Wucy
                                                                                                                                                                                                      MD5:E2FB918E63CF2E8629227FD873A5A362
                                                                                                                                                                                                      SHA1:8CB0D496D8A7FE7359537B6B33FBE521A1DCA32A
                                                                                                                                                                                                      SHA-256:44C708835AE7F657AB5C07A465ED9375C810D907D1A17A5C33B31C2482515080
                                                                                                                                                                                                      SHA-512:CA91972D7ECD199F23304581D190F86AE9D0196BF7C7307C9F9E4AC84F9BD8D0C13D4BD4E5A1D3DB00F1837B468837789902620C974704B6C07866C23FE7A79D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........bk...8...8...8.8...8A..8...8...8...8...8`..8...8...8.8a8...8.8w8...8...8...8...8...8...8...8.8...8...8...8Rich...8........PE..L...qk.Q...........!.........X.......".......................................@......F.....@......................... ...y.......................................-...................................V..@............................................text............................... ..`.rdata..............................@..@.data...<>..........................@....rsrc...............................@..@.reloc...F.......H..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtfilm.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):799920
                                                                                                                                                                                                      Entropy (8bit):6.4627860261767065
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:4jM/yrSizUTnIzVWz7PWY9F9Y8yVrpfiFRJyNLcE:AliXJycE
                                                                                                                                                                                                      MD5:BE550CCD74044C170270D76FB2B38D2F
                                                                                                                                                                                                      SHA1:A87F969DD5F4744323CC3C7B49231E2117CABF7F
                                                                                                                                                                                                      SHA-256:1AAC90BF0D24CD4B164BCFFA338B4CFF3102C12769FD0A0777F2B964CFDDC8BA
                                                                                                                                                                                                      SHA-512:32C82C00F2097CBC42AB0308B7F35096C99014E9E93710B0FC027CEC0272B086AC745F31CF01490AA6117D4C6A2B215E01B67A942259CA49719A3097AB70854E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`..i.F.i.F.i.Fh&.F.i.F...F.i.F.;.F.i.F...F.i.F...Foi.F.cF.i.F.uF.i.F.i.F.h.F...F.i.F.;.F.i.F...F.i.FRich.i.F........PE..L....ZQ..................................... ....@.......................................@.............................................D......................(....'..............................h...@............ ...............................text............................... ..`.rdata....... ......................@..@.data............V..................@....rsrc....D.......F..................@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtswitcher.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):146792
                                                                                                                                                                                                      Entropy (8bit):6.652917793404133
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:c8D6ap8rG5eDM8iTbcGiTKiSOufcReWTBf+r5wHvOc:c8ppeG5eP6itSaeWTB3POc
                                                                                                                                                                                                      MD5:A0778C2A0DCFF99F83CB63DB2537C0D6
                                                                                                                                                                                                      SHA1:253F2B000F046C62D77B48A87A4A99819D647996
                                                                                                                                                                                                      SHA-256:5C5BC028291B1940D03036F0D125EDB17BD2E6D3BE66900A16CD98B739507F2C
                                                                                                                                                                                                      SHA-512:84B058608B781B3383CCEB9A3FF26602E631CC398FD57C310EF785573F1FF6DA23070957D4554F6FA8526ABC6A6141432E154F186A4AF4D926C36BC5B414F8E6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S)V..H8..H8..H8......H8..0...H8..0..H8..0.. H8.0.U..H8.0.C..H8..H9..H8..0...H8..0...H8......H8..0...H8.Rich.H8.........PE..L......Q...........!.....d................................................................@..........................................@...............*..h....P..\.......................................@...............0............................text....b.......d.................. ..`.rdata...x.......z...h..............@..@.data....>..........................@....rsrc........@......................@..@.reloc...)...P...*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtswitcher64.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):167544
                                                                                                                                                                                                      Entropy (8bit):6.3438521480270085
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:QAI9+Gkf+xVpBHO9mNMy4ZFMV2bWqtsRi2TBf7sWr5qJcR2:zI9+GPJNMy4Pw2b+i2TBwWcW2
                                                                                                                                                                                                      MD5:F54B6E8B821138CE6110DE7B964E53D8
                                                                                                                                                                                                      SHA1:0EEFD010E4C9001B795B8A81FF2B8BDEB854A219
                                                                                                                                                                                                      SHA-256:DD983F896F412B264B9D0E2B296C63FFD750B81E1240794B312C967752D89DC0
                                                                                                                                                                                                      SHA-512:AC5BD4F315F3FDA20EAA0CAFC371491D936E1389C517B093CD561888FDBB96457A8F1848047F519419B86495BA890C394873CE998E6F5BCBDD746A533BA92C44
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jR.............3.......................................3i......3..........y...................................Rich............PE..d...h..Q.........." ................................................................(.....@..........................................P......x;.......................z..x.......|.......................................................p............................text.............................. ..`.rdata..............................@..@.data...PK...`.......:..............@....pdata...............V..............@..@.rsrc................n..............@..@.reloc..F............t..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtwebbrowser.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):760168
                                                                                                                                                                                                      Entropy (8bit):6.41146860850765
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:QZKD6SfHPAf/Xjd8xob+5kcc4cfpcJIU1GhDan4Jz/izR36nYNTYhrW6ZLsvMq:QZQkKxob1cG3U8hDa4JCR3YYNTYhy6m7
                                                                                                                                                                                                      MD5:26464985B396AE1DB6A2D6E7B070A3C8
                                                                                                                                                                                                      SHA1:D102D7817311F1999D0251A80DFEAC2895E8B0C1
                                                                                                                                                                                                      SHA-256:93AEF6CA6FA760D3783EE1157B3E9EAE1F6EE21C3D1BE39D4485DE6DA70F21E7
                                                                                                                                                                                                      SHA-512:FA2E8D7B352F05C696916FCF762A47BEFE119FD51148DC525F2AB569E98FC94E97EC1369E4ABDF07151069464DC9839E61C063C0336E6EA16A18F72F7EDDB5B7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1y..P.Z.P.Z.P.Z...Z.P.Z.(.Z.P.Z...Z.P.Z.(.Z.P.Z.(.Z.P.Z..zZ.P.Z..lZ.P.Z.P.Z.Q.Z.(.Z.P.Z...Z.P.Z.(.Z.P.ZRich.P.Z................PE..L......P.................L...6......it.......`....@.................................R8....@.............................................................h....P...w..@g..................................@............`...............................text...kJ.......L.................. ..`.rdata...{...`...|...P..............@..@.data............H..................@....rsrc...............................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\dtwebframe.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):171480
                                                                                                                                                                                                      Entropy (8bit):6.44138290249757
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:F4qo0pTzJR9UoHQfxhKQ2ulRCW/ZfGEAkz5GRWGgTo:uYT1X00Q2ulRCWBfVY3gTo
                                                                                                                                                                                                      MD5:755FE45383AAA53782A41CA691F700F1
                                                                                                                                                                                                      SHA1:405182FD8BD46541018002749DB2185364A2FD2C
                                                                                                                                                                                                      SHA-256:1BCA911A9D638D11634F4B1D27AED484163355ABA41E78312EE9DBDB7F062CA7
                                                                                                                                                                                                      SHA-512:BAE5191CF2544F8F107944483EA8298A5319E37779A162423A837F1B8E6C203CDD0692AFB9077A895C3BC16F1951C50263164A041EF3CAE69D95E00C978C3E91
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...up..up..up...?..tp..|...dp..|....p..|...Op..R...qp..R...dp..up...p..|...|p..|...tp..k"..tp..|...tp..Richup..........................PE..L.....[Q...........!................"...............................................R.....@.........................`4..~...\$.......................z...#......` ..`...............................0...@............................................text.............................. ..`.rdata...t.......v..................@..@.data...XA...@...$... ..............@....rsrc................D..............@..@.reloc.../.......0...J..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\feedback.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\flashApp.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):385200
                                                                                                                                                                                                      Entropy (8bit):7.182105590695188
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:MEvvCXZPBZirt5lLK8WqZaWZYlY2hE8XqYR/pURWepSmEU:M6CXdBZirtvxDZNYl44q+paWOSm
                                                                                                                                                                                                      MD5:28580334E670277D005E38D4C9E65CFD
                                                                                                                                                                                                      SHA1:7EBAF822980EE5DB3A7ADC20C5F266704433210C
                                                                                                                                                                                                      SHA-256:E4A42DD9B58F3D7B0A8493B837769C5D32DBF5EDE29A805E3808D4530E410E45
                                                                                                                                                                                                      SHA-512:1EF9C47842477F3F7553C5B9CAA30ACC2D1DCA73F3DF86F2E608DA9027B44AAE5B338DF389A7E050B2DF53CF8D20724596411392307F856D6E9CDA90F4F82AB8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................M.).......*......;.......<.@....9.......9...............6.......;.....+.............Rich....................PE..L...3..Q.................*.........._:.......@....@..................................p....@.................................@........................................D..................................@............@...............................text....(.......*.................. ..`.rdata...y...@...z..................@..@.data...............................@....rsrc...............................@..@.reloc..6l.......n...X..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\360GameBox.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1143104
                                                                                                                                                                                                      Entropy (8bit):6.908541805805633
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:M7rMZ9VnpbFmR3Wjih7gK3FNhAuqtqo40gu9xZu9xZoPyL7:8rm9VnphmQihVhAuYqo0u9Xu9XNL7
                                                                                                                                                                                                      MD5:8DD4CE4D5EEE031135A64117731F0187
                                                                                                                                                                                                      SHA1:139CB0851FDFEF952BC80307F22B9132B941F64E
                                                                                                                                                                                                      SHA-256:428A0546DCF68A9ACB6A2CDC6082168652E3D315493230D06C80102BD3D09B1E
                                                                                                                                                                                                      SHA-512:1930E581329EEC9B64AE1949AE84563E3F247C7AFF5622ADDB289D1630FB3364BF295CD1D610207D6B5BBB5FCEEC951614AEC9CA8DA4687333BA706D96D9E757
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..6...e...e...e...e...e...e...e...eM..e!X.e...e!X.e...e...e...e...eP..e...e...e...e...eRich...e................PE..L.....Q.....................t....................@.................................e.....@....................................,....P...............R..@....0..........................................@...............(............................text...:........................... ..`.rdata..P...........................@..@.data............<..................@....rsrc........P......................@..@.reloc..T....0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\360GbApp.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2015408
                                                                                                                                                                                                      Entropy (8bit):6.301459019627537
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:fxHf82WTNblrzv1I3pF4HYvMFkzFqv+IFPpds07XTuG+W40oS7B7L9xZY00:fxE9I3H4YCdpz7DuGvoGB7L9XN0
                                                                                                                                                                                                      MD5:F20C9B80E5D66E079E4350A1BA0F6295
                                                                                                                                                                                                      SHA1:1379EE0823F1B3284611B20F079CC7679C5B4FCE
                                                                                                                                                                                                      SHA-256:7764AABF7B2B1756980BEEB384A63106841188DC03A9EDDB79F8F2FE451B8757
                                                                                                                                                                                                      SHA-512:8B8608B1B318CF63D86AD4CD66BEACE9A0F294E9F986694B9DEB8C7A3338EFA05F8A0714A9EF6CCAE1384DE0452B29C603421AC00ECB1A489D6EEFC0FB6077B8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V.........w.S......P......A......F.u....~.......~.............A.......O.N.....Q......T....Rich...................PE..L...v2vQ.................t..........R.............@.......................... .......5....@.....................................|....`..Dn..........................................................H#..@...............t............................text....r.......t.................. ..`.rdata...............x..............@..@.data...d........Z..................@....rsrc...Dn...`...p..................@..@.reloc..hK.......L...Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\AppcenterDataGb.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):642920
                                                                                                                                                                                                      Entropy (8bit):6.282990832147541
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:5qBB65rJHvhc5gWES4bpbDBCWSul20XW6+MSP95HiVNT3yUO5VZPIxT2AdhWXhlG:7rYUbpnBCWSGP2AWXh5569l
                                                                                                                                                                                                      MD5:C9DCDAE63FC4BC3BED7298E7C6FB3D15
                                                                                                                                                                                                      SHA1:F573C038E3E005172F475FD4EE805060926BA3CD
                                                                                                                                                                                                      SHA-256:468A1EB791002CFC420EBF42DF8D9F07DD345B630584D30A74305EA0F0F62329
                                                                                                                                                                                                      SHA-512:2AC67254AFB1F12C8723FC031B95E73F8F07F15E2781CDFBDB03EB0C5D78CEEA47A52AD8864E3B7A488E96EC13B926F20265CB811F04F6F51A45E9E9A1E1A060
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S..S..S..t...R..M.n.V...|.R..Z...I..Z.i....Z.n....t...\..S.....Z.`.~..Z.x.R..M.~.R..Z.{.R..RichS..................PE..L.....%Q...........!.....H...p..............`............................... ......-.....@.........................`........t..x.......................h.......tT...b......................H...........@............`..l............................text....G.......H.................. ..`.rdata..."...`...$...L..............@..@.data...8U.......4...p..............@....tls....I...........................@....rsrc................B..............@..@.reloc..Ds.......t...H..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GameBox.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):156848
                                                                                                                                                                                                      Entropy (8bit):6.538614114866669
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:2c7Qonv+JBCrms558lMUVnUWxYAJ/Rtrpt2sytOSigKPiSj2eMsRw8e6ciPyyp5B:2G8Crms/8FnPBT7gxShAmwA5cgTx+
                                                                                                                                                                                                      MD5:46D0C5A9F1DFAFB0B842BCB2A944B1C5
                                                                                                                                                                                                      SHA1:233B8E2769625DD09A576035189D4CA3327E02A6
                                                                                                                                                                                                      SHA-256:BF84D8270CC9C4100D8DD52CFF5DEDD30CEDFF723BE38929FA32400BE5D97D8D
                                                                                                                                                                                                      SHA-512:E5026A954F575D4FB24109CAC306AC1D848EA62B16475CDC450D3CEFB4B93E1BC45559E99059F927FC2ADBCE7F95EA11BE2A45A7CCA2894C5AA6310F7355D855
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`.&...u...u...u.yVu...u.y@u,..u.yGu...u..u...u..u...u...up..u.yIu...u.yQu...u.SWu...u.yRu...uRich...u................PE..L.....RQ...........!................................................................x+....@.............................I............`...............J.......p..4...................................p...@...............,............................text............................... ..`.rdata..YF.......H..................@..@.data...H?... ......................@....rsrc........`......................@..@.reloc...&...p...(..."..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\gamebox\GameBoxCore.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1124528
                                                                                                                                                                                                      Entropy (8bit):6.484809189310972
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:Dp6e4S9JuvOCZLmvTO33iFnzQkOMnNf1bt:8S2OOGOMNf1bt
                                                                                                                                                                                                      MD5:5619853A5AC4F54323F54A949160EA52
                                                                                                                                                                                                      SHA1:60D787F954C12A23AB17DDED9F91C6C4B0B22173
                                                                                                                                                                                                      SHA-256:937EC6B0A8D5EFCA5E35F09A11BB6BDDA44FB4EFB9E0CBB9899BF67287820F3A
                                                                                                                                                                                                      SHA-512:1607C6A9614F5D5809BBDBA801E9BD2111977AEAE2114B35FA3110E662ED158AA107D6B2732579F7F34D26424D9C52B3800F0A045787F84363B13C8787B6A876
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j...j...j...8?..j..e%-..j.......j....8.ej....?..j......j.......j...j..Ok....1..j....)..j...8/..j....*..j..Rich.j..........................PE..L...$PUQ...........!.....l...........................................................Y....@.............................t...4........p............................................................. e..@............................................text....j.......l.................. ..`.rdata...+.......,...p..............@..@.data...\........v..................@....rsrc........p......................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\img_reader.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):203608
                                                                                                                                                                                                      Entropy (8bit):6.832543174324689
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:CxIYp86FpmNh/ZBypa4ZunTBfHFy6Ag0Fug795fz8:e86As2nTBvFy6AOIvo
                                                                                                                                                                                                      MD5:D3A9CA700C1C65D6DF7E010B0CB0E3F4
                                                                                                                                                                                                      SHA1:8E35CFC937B783808DA98376B5ED6163BD77148A
                                                                                                                                                                                                      SHA-256:CC4D278AB85A0CEF68EF29FDBF723830C4F2BCC78B5B315F1530674059BCF0CE
                                                                                                                                                                                                      SHA-512:8102BFEC316B89BF100350607491942332E881AA80981AEAEF8F607CAD5A4661B8E07BD9FE74506D8D775A56FACE181CF342074668338D42A3250A041AED4269
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...............u{...................uj.....um.0....u|......_z......u......Rich............PE..L....HdN...........!.................6....... ...............................P......x0..............................P...K.......<.... ..................X....0..........................................@............ ..,............................text............................... ..`.rdata....... ......................@..@.data....3..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\oauthlogin.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):343680
                                                                                                                                                                                                      Entropy (8bit):6.438296507662578
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:Od5qu1VG/cPM45zTHtcpBBzCXkLDLdfewus5qdr2ZdS1ltQp6:Odgu1VG/cPM4uBzCXkPLkwuwiu6
                                                                                                                                                                                                      MD5:A1ECB29EC8237F21ABD334830573EC34
                                                                                                                                                                                                      SHA1:DAD2D8F5976A018F3A5FE95C7DA5D8744971D5F8
                                                                                                                                                                                                      SHA-256:AB07B5413EB43D56151EA1B072945A3FC0C075BF108AE9977EDB46B7D102E9E9
                                                                                                                                                                                                      SHA-512:EABF128304CAB9540556984C43EFCA678897CA9DA07D5949C698156A6C38E8A23D037E98B7138D1930C33403185BDAACC842C79EFBA20FBEBB1379C437A2DEEB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tF..'F..'F..'O.3'W..'O.%'+..'aV.'A..'aV.'I..'F..'...'O."'|..'X.2'G..'O.7'G..'RichF..'................PE..L....NuP.....................t....................@..........................`.......>....@................................. m...........\...........(.......0...+...................................<..@...............|............................text...Q........................... ..`.rdata..J...........................@..@.data....E.......(...t..............@....rsrc....\.......^..................@..@.reloc..B,...0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\processinfo.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\softdt.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\softsignore.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somQuickInstdt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):388456
                                                                                                                                                                                                      Entropy (8bit):6.442900380359452
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:KHmBujRyg2UZO8dH2wi4ZF5sd9EbN3W09QqLNRvk9Mr9mcF0+ghddwgXcDWejmRO:SgYRyPUZOeri4ZF5sd9E8GNDrQcIdTX8
                                                                                                                                                                                                      MD5:572E8D9AF871FA484DB3BFAE444E4C0C
                                                                                                                                                                                                      SHA1:229A15E9FA3E389AB9575A297963437432CBD776
                                                                                                                                                                                                      SHA-256:23E505F80D5A1DE15AFC6E015A062315237E92114BE9B7F9025F36F66D982315
                                                                                                                                                                                                      SHA-512:1562BB358894AD463BD5131844CC206A473C44C325045C8C56C8F7B203631F37CD31122C1624E4F509B9B324508DE02C8139F9B1299DFB183D5643DC5C332D9D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.P.y.>.y.>.y.>.p..`.>.p..7.>.p...>.^NS.{.>.^NE.b.>.y.?...>.p..n.>.p..x.>.g..x.>.p..x.>.Richy.>.........PE..L...L7.P...........!.........4.......T.......................................@......&H....@..........................o..f...,\..........................h....... 2.. ...............................X...@...............t............................text...'........................... ..`.rdata..............................@..@.data....@...........X..............@....rsrc................t..............@..@.reloc..._.......`...z..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somcoredt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):825008
                                                                                                                                                                                                      Entropy (8bit):6.5491447938841825
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:eY4r48i/je7GlpPMDV3be+wkhrx5dR/bPkuaYLdp2ku5ZGSlpTs6ILauDp:qr48i/j8YPMRrwk/RasdQkATfTB4p
                                                                                                                                                                                                      MD5:AD7141EBC34468ECE687A5399FB1B05E
                                                                                                                                                                                                      SHA1:159079879E57D6C1E4E599D7EBFA58EAC289D0F4
                                                                                                                                                                                                      SHA-256:451ED78D762B64984402DC939228C00AE608FC9D1B1BC3BF6EDB767F27462FAF
                                                                                                                                                                                                      SHA-512:99921BA6E7EC23C47B3AA9A275ABAF42B80EAF25773EDF13CD50DB60A00CEFB393DC376C238C31D1D66661771A2FB6844DFC576C2C325D29749E431EC2516A17
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......67..rVb^rVb^rVb^l..^wVb^...^sVb^{..^hVb^{..^.Vb^{..^.Vb^U..^tVb^U..^oVb^rVc^VWb^{..^GVb^{..^sVb^l..^sVb^{..^sVb^RichrVb^................PE..L...u4.Q...........!.....................................................................@......................... ...F............ ...............|.......0..dq..0...................................@...............,............................text...Z........................... ..`.rdata..f...........................@..@.data...<r.......>..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\somkernldt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1257928
                                                                                                                                                                                                      Entropy (8bit):6.637557852291585
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:kCHfpvtT6uNohYg07OmzFCN26/5JIqfjNm+uoSNt7LJi4uUDzBeDpnE2IVs5Puwj:kCC5K7OmzF57Puo0aYuTBcPP
                                                                                                                                                                                                      MD5:B04F80F63C9A0ABF6A287ADC4AC661E4
                                                                                                                                                                                                      SHA1:54E9CB2396FD8708CF40B44F8D51DECEA38BC52E
                                                                                                                                                                                                      SHA-256:BDBD8D832B8C6E8AFCFBA93FDC656629A34D7721FD2339D346A26FF2495268C0
                                                                                                                                                                                                      SHA-512:7B9DDAB383E7482D05FB20A6106C2044779AFC2CBA557B953C812A8872B1272593BDC656C3BD2C7F70126BB4A852958BE84EEEAE69F3C9C12DA46C2140A9F4A6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:d}.:d}.:d}.B.}.:d}.B.}.:d}...}.:d}...}.:d}.:e}=:d}..v}.:d}.:d}.:d}.B.}A:d}.B.}.:d}.B.}.:d}.h.}.:d}.B.}.:d}Rich.:d}........PE..L...'..P...........!.....h..........................................................`.....@.........................`...[............0.......................@...}...................................................................................text....f.......h.................. ..`.rdata...W.......X...l..............@..@.data....(..........................@....data1...............d..............@....rsrc........0......................@..@.reloc..|....@......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\sqlite3.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):423584
                                                                                                                                                                                                      Entropy (8bit):6.683424538324543
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:Yz0fZUselMRqlkPUyZWTQHkK67VTZ6pGBdmkRL6iH3/BoqnuF:hSyZC7WpGBdmkRL6ipo+uF
                                                                                                                                                                                                      MD5:4D1B78591D892A54DD795AD3F7336756
                                                                                                                                                                                                      SHA1:7935FB2758003BB3BBE9C58811DB71323FD66353
                                                                                                                                                                                                      SHA-256:2938CCE7F5716AF3D6317D1617DD3B2E8C212A11FD91DE95AE0713D8E2FFE0C2
                                                                                                                                                                                                      SHA-512:17A5D93430A39F55CFFBD892B89560710B082555D714EE629C5E399B386B3F5A30F6C47E202E3E3FE8637DDEFE2C98D0CABF8DD67D10A0555719A6F765129052
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.?..kQ..kQ..kQ..w_..kQ.yt[..kQ.ytU..kQ..c...kQ..kP.TkQ. M[.YkQ. MZ..kQ..mW..kQ..KU..kQ.Rich.kQ.........................PE..L...k..L...........!.....0... ......)7.......@...............................`......8&...............................|..W...Xw..<....0..`............`.......@.......A...............................................@...............................text...6(.......0.................. ..`.rdata..GS...@...`...@..............@..@.data..............................@....rsrc...`....0.......0..............@..@.reloc.......@... ...@..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Bin\weather.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Config\config.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\DumpReport.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):216704
                                                                                                                                                                                                      Entropy (8bit):6.532910128712557
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:l6VgjYzDal0nZySd3cZeC8PLErN1wuLydldZG649oL7xG4KKLylg5KMit8GC:kGczDu0kSdMeXLErN1wuLAlY9GdG/zbC
                                                                                                                                                                                                      MD5:E2CF8C3384795D23631D1A1B86E33FDF
                                                                                                                                                                                                      SHA1:FE160C83C7BB1EA2C8D4494C7BF91474B47CA5D8
                                                                                                                                                                                                      SHA-256:319227E2202B3B72CE20107A5FD05B90E89A69492D9F5DBACA3EDA95D2C86AD3
                                                                                                                                                                                                      SHA-512:AC579907580185D7809736AF2037623DFFED5F83B8FE0474238233EFE20F3001176D5007F0360F281E6D1DCC1EA74146681E642FBDF48228227ECD7998AFB822
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..q:..":..":.."...";.."3.."#.."3.."...".x.";..".x."-..":.."..".."1.."3.."w.."$..";.."3..";.."Rich:.."........................PE..L....q.P.................f........................@.........................................................................$........`...............8...............................................................................................text...ld.......f.................. ..`.rdata...~...........j..............@..@.data....P.......2..................@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\LiveUpd360.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):399344
                                                                                                                                                                                                      Entropy (8bit):6.525659947793564
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:Q60nOaN+UpBOp+j1stF+sb6YkgXti5Y2ch+:QJ06fIQ5Y2S+
                                                                                                                                                                                                      MD5:77106684F45C7C504B21AD948956734E
                                                                                                                                                                                                      SHA1:5043039A8BC35EE71D8F17B921F35D6DEBF01831
                                                                                                                                                                                                      SHA-256:F3803AB55BBFFFECA21BAB8BED43004A0DD019B1A97196602825E1D1D61C9554
                                                                                                                                                                                                      SHA-512:4DC02E47B6071395D7CDA332CE74109F92682C7A00346C3DC0160D9747881D78A93F38B20A7C4CEB1B5E25B1E6CC86D3AAC98780AE40F3378C4DE007CA951C9D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qW. 56.s56.s56.s...s46.s.y.s46.s<N.s)6.s<N.s.6.s...s"6.s56.s.6.s<N.sU6.s<N.s46.s+d.s46.s<N.s46.sRich56.s................PE..L....q.P...........!.........>.......+...............................................l................................../............@.......................P..|....................................U..@...............0............................text.............................. ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@.reloc..@D...P...F..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\LiveUpdate360.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):811656
                                                                                                                                                                                                      Entropy (8bit):6.876739267086473
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:FNi+QMNY5S0yQVkt/ozaCcTG8ky/D4CUpkJ8:FiboQWRozU/D4CUpkJ8
                                                                                                                                                                                                      MD5:41D9C718B95D971613AE0DD97487A3B0
                                                                                                                                                                                                      SHA1:1294F7361FD7CF3B40ADE74E72B1140C9C4CCD4D
                                                                                                                                                                                                      SHA-256:DA3AE4C54360E717F727F09152B5BBC91696501BBA4DEB727ECB868D1E66E818
                                                                                                                                                                                                      SHA-512:6E9ECDBE00F05CCCBB33013EFAD0661D0EB9FBCCEB1C4BFE24D619C06A34DEC9817BE2E53A925B34BB769700A4020247958C60C11B954E2A24CBD9BC4E635B7C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O..@.4..O...77..O...7!.SO.....O.....O...O...N...P...O...7&..O....6..O...73..O..Rich.O..................PE..L....r.P.....................J......UX............@..................................G..........................................@....................L..............0................................................................................text............................... ..`.rdata..............................@..@.data...Xt.......@..................@....rsrc................<..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\PDown.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):210408
                                                                                                                                                                                                      Entropy (8bit):6.507157820903005
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:TJnuJFUvm00JlB8uLp/Me7AQo7ZWQueVMAI64kliFa/nyG5e0P9:9nuJFUvSJP/Bid9/VMg4klfiI9
                                                                                                                                                                                                      MD5:23944F2C8C2614814CD9EEEAD7C15622
                                                                                                                                                                                                      SHA1:FE5BFBED6900D976AC56EAC386423D82A35BDE7E
                                                                                                                                                                                                      SHA-256:68CB47636533713F460FA932975189BEFB0DDCA0750E8F75418B6C616F9BA3BA
                                                                                                                                                                                                      SHA-512:C16AC9EB39375950E554CB6C2814ECD385D39F2729DC2B26618647705D99DE7A2626759C3DEEB8C8A12E7658ECE6A5569FB1EF5D01B8F1CB8CFFAD7EEFE92555
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................o.~......}......k.A....K.........h.....l......z......|......y....Rich...........PE..L....q.P...........!.....L...........N.......`...............................`.......3............................................... .......................0..`....c..............................`...@............`...............................text....J.......L.................. ..`.rdata...y...`...z...P..............@..@.data...@<..........................@....rsrc........ ......................@..@.reloc..^*...0...,..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Safelive.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):397240
                                                                                                                                                                                                      Entropy (8bit):6.559659900193761
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:gG1eHqeh0S21bC5k+5HsprlHPohiLesYTM7Pol5Cm6Kmvn7/OZcnPxNWj:h1eKeDp5kwMprlwYlYUPol5Cmdmvn4j
                                                                                                                                                                                                      MD5:EF03AA3534F302E6A4DE1FA6BB6C9678
                                                                                                                                                                                                      SHA1:6A67D0BD8BDDFBE0479BBDD4166281FF3DCD0D7A
                                                                                                                                                                                                      SHA-256:E7CCEAF1534BEF4F656E72C8069BC82BBA836774868A39F5691E7D4BF9EF6450
                                                                                                                                                                                                      SHA-512:650D9156F3A185801D1B57845ECEDAEDF1A392E5EB8341E5537AE082FE8D7D3749B30B6878A41EB4BF9204C4DAC535C3614859B1CD65D25CACB95695FA383540
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}..S2<..}....?..}.....}.....}...}...|.......}....).U}....8..}.../>..}....;..}..Rich.}..................PE..L.....kQ...........!.....z...v.......U.......................................P.......................................j.......S..@...............................L5..`...................................@............................................text....z.......z.................. ..`.rdata...............~..............@..@.data...D[...p...6...Z..............@....IShareO............................@....rsrc...............................@..@.reloc..2O.......P..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\Uninstall.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1146032
                                                                                                                                                                                                      Entropy (8bit):7.1292448119285154
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:+jcxTzOiH74zs4urel9BlKfEZzss4Ueh4ffGs6bW2iYjS:+j1CKorel9icZzD4fh4fP6K8S
                                                                                                                                                                                                      MD5:B856763537C16C746EDCF36EFC187930
                                                                                                                                                                                                      SHA1:E384680D705C4098FF825B2B0F2ADD6FF7C40BA5
                                                                                                                                                                                                      SHA-256:585AFCC72620246453007DD33819E85F8B677DC2896C81BBB25F3A8BD05E4F68
                                                                                                                                                                                                      SHA-512:4F9A69E2689F4240C569DC3AB7CEB0C5EC094B3D355591F6EE30A3A6B15B7FF11DB2E7FB0038A5011F0615E68DE8D7FCBE2A193A88646EB2D129FD45DD37B133
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7I.OV'.OV'.OV'.....KV'.F...SV'.Q...JV'.F....V'.F...\V'.h.J.KV'.h.\.hV'.OV&..W'.F....V'.Q...NV'.F...NV'.RichOV'.........................PE..L...3w.Q..........................................@..................................-....@..................................>...........7...........b....... ..Dt.................................p...@............................................text...,........................... ..`.rdata..............................@..@.data....i...p...>...H..............@....rsrc....7.......8..................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\MiniAppdata.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\Music\douban\douban.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5144
                                                                                                                                                                                                      Entropy (8bit):7.924303008935322
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:jSMllcHitlIxv9vk7C1+I4wWHLihk/x/XRzAd/7rtYWcuS4TV/zoCQG:jSHIIHUCD4wanAdvti4TWC7
                                                                                                                                                                                                      MD5:278C49FB3BC908F88B2FCF0C59A3EFA4
                                                                                                                                                                                                      SHA1:4DAF8D31656B057973261DA592D210486B2A5E63
                                                                                                                                                                                                      SHA-256:64AC53712D212CA020E4FC8D5DCBC262AEEA36084647079D0B3F9826BC0D1BB9
                                                                                                                                                                                                      SHA-512:623266DBDE05F850F99B8AB31239CF2183B620079D8E5D1CC193EFABEE527192BFFE90C3EC4CD2C96483AEA64E7A5F3A4DFBD98C35556BF254659FF17A2C57E9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\Music\jingfm\jingfm.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7971
                                                                                                                                                                                                      Entropy (8bit):7.956521088757676
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wauVFxHUELpeNDF8pW+ZYibvAmX:W50wzbxHpeGb/b
                                                                                                                                                                                                      MD5:E670AB623C433324324FEC4B53DAB011
                                                                                                                                                                                                      SHA1:82D79DCAE81F58EABD8EF76C17EC6057F13BD9D8
                                                                                                                                                                                                      SHA-256:880D829FC1F50EBFD4567F21D190966BB6283C03D5ABEA5C05753DD73726BF6F
                                                                                                                                                                                                      SHA-512:E206D1D4BFE38D2000AADB54E797F192A4DC364C24F53972D6FD64F975C6B68E01F85DD2BA3EE173061BFB02955231D9801362CAA729B8B15DB8EFA73391D8D3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\Music\kugou\kugou.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8086
                                                                                                                                                                                                      Entropy (8bit):7.96318899322068
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wakANE0zB4bPD3FX2Xa+AjGLf+ZBHq:W50wZAN7qr/jGLfCBHq
                                                                                                                                                                                                      MD5:1752E6A102C825F40CAC0102CA4389D3
                                                                                                                                                                                                      SHA1:FEA1008EE4EBC636C20AA6E78145802F498FA4BD
                                                                                                                                                                                                      SHA-256:5A44CAEDAE5C4FBAAB8AF9FC71B320E2F85ACB879420DF4C4962D87226E8F7EC
                                                                                                                                                                                                      SHA-512:C436B3AEE7107478C93ECDC8FAA941F43DD830CC492073803D9420D91B0C1C077B437423E2A013DC46D11A26A549EC2751E903882097A54FAD4E82542D1BF036
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\Music\kuwo\kuwo.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8115
                                                                                                                                                                                                      Entropy (8bit):7.965265564609039
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4waeV8OpYHbC8iBo7IDEeENYwWLTzmakArjP:W50wj9u8qIDEeENYZHvZ7
                                                                                                                                                                                                      MD5:440543B6F1CC1F444E6A5FE8E5247D09
                                                                                                                                                                                                      SHA1:0C3E16121D76EFDE609E48C571D90F711F84AB9B
                                                                                                                                                                                                      SHA-256:7EDDECC40D5206764122F3C5632DDA068FF6E20F8C2C043B3B596E9D69FF6507
                                                                                                                                                                                                      SHA-512:3EC7D77984AD04FB16ECADD83F0295CCDC1CB762C2C5877DEEE25D5CB1F32139C306ADF7A6D7D706F694A3AB9FEBF0E4E8500E2D7E8F9DE27ECC915C18EA61CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\bak\Config.nxdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):290
                                                                                                                                                                                                      Entropy (8bit):4.645472736563747
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:TMVBdxdaT0x3OY0FgU3OY00mxFxpyRdL1Li3OY9WhblIW5:TMHdxdaToYgUHmxPudpLisZIW
                                                                                                                                                                                                      MD5:D4C64B72909AC4E1A9D967BAB4CBEBCE
                                                                                                                                                                                                      SHA1:C9E6212F312A0084112B8E909EEF04C28FD3C81A
                                                                                                                                                                                                      SHA-256:8ECCCE53B3E4F3A052D15C40391B883AEB5ED3B0F17750FC131D19A57EC6FDF0
                                                                                                                                                                                                      SHA-512:E260F51650C704BB8869CE0D4739F00C4D9EA53E14F58678E7760F0B0F930E8584162CE3C1851E100C3C8376656B459ABA71E8204ED4AC362A80BE24A91DF0C3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" ?>.<configs>. <SEG sn="SettingCenter">. <ITEM k="14" v="3" />. <ITEM k="15" v="3" />. </SEG>. <SEG sn="FavItems">. <ARRAY k="ItemArray">. </ARRAY>. <ITEM k="NoImport" v="1" />. </SEG>.</configs>............

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Desktop\import.fg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):78
                                                                                                                                                                                                      Entropy (8bit):4.367903661777143
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:L58BhYUyC2MYRAQHX5ov:uMUyCrYeQHX2v
                                                                                                                                                                                                      MD5:6484C6AC89C6DD619A9B1E613C77E66D
                                                                                                                                                                                                      SHA1:6462D4DCCA4ACC69CA0BF40C31AF4AF68F3BF29B
                                                                                                                                                                                                      SHA-256:1FA27708E6D3FFAE9C1090ABDD4C3514C1233008A66D94568F3A3E9E559EC1EB
                                                                                                                                                                                                      SHA-512:F5E4CB990E5F3BE1918BEB7056BA831C1C200E4D0B351224D28E4DAB23D3D279188573E3309F95333F25B56D4D701B7DE70FB2702558356055DD45230E8ED61F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[import]..version_opr=2..fullscreen=1..system=3..runpreview=1..shownewuser=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4405112
                                                                                                                                                                                                      Entropy (8bit):6.54104069780479
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:kZoX2uGyQPd38V3ScT44Q6SrRaVWiXk+NolDH8k1VbAxwhvcL5b+xal50+pTRT3q:WndPd38VCON0+rk1Vbm5bEA0+7qf
                                                                                                                                                                                                      MD5:F1C9C0C1425BBCCF47C1AFB1302F59FF
                                                                                                                                                                                                      SHA1:24A0CE9D29449164B50F7C8B6BB50F130762A467
                                                                                                                                                                                                      SHA-256:073FD886ABC9132482C8B9B944473C08CEB8604187BBA3A5E4DAC0221C4C383C
                                                                                                                                                                                                      SHA-512:CE7E415A3ECAB14F3747D51C9619700D65141E3349C5E56E937D0A16BB6FECF2FA5295B3ACA95AAF9AAA954877CB422C5BE8A955E3FD2D8171736BD050AAA332
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.exe, Author: Joe Security
                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...yn.P.................$8.........X38......@8...@...........................J.......D..........@....................<......p<..I....A.............."C.x...}.J...............................<......................................................text.....7.......7................. ..`.itext...(....8..*....7............. ..`.data........@8......(8.............@....bss..........9.......9..................idata...I...p<..J....9.............@....didata.......<.......9.............@....edata........<.......9.............@..@.tls..........<.......:..................rdata........<.......:.............@..@.reloc.. .....=.......:..................rsrc.........A.......:.............@..@QProtect.0....I..$....A............. ...................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360seNotify.rs

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):695672
                                                                                                                                                                                                      Entropy (8bit):7.872174101935894
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:9iqXVf+i83kCL4fa4gfL4fa4gfyAb7QvzAuA1UmLpflEddb8b:kqXVl8nyAbUvMuA1UmBWD8b
                                                                                                                                                                                                      MD5:AFCE1572F712D14924A54D6C6D85A253
                                                                                                                                                                                                      SHA1:DC5D68D5F32CAF04F88875AA69AB3F0B62239513
                                                                                                                                                                                                      SHA-256:A7D817E4CC497496E98CF1463A0E490ECB0DFB83BEB9E2B21A23DA911D75F699
                                                                                                                                                                                                      SHA-512:25F611690B8133ACFEA262A902B76843AD0753599503D45232D02946ED0248A7CEE8A39C772853E512004AA93C3E657BF9D8B66D26BB36AD19011875DDBF7F4F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....ZP.................8...L.......P.......`....@..................................2...................................................:..............x...........................................................................................text....4.......6.................. ..`.itext.......P.......:.............. ..`.data........`.......<..............@....bss....|+...p.......D...................idata...............D..............@....reloc...............H..............@..B.rsrc....:.......:...N..............@..@....................................@..@................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\360weibo.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2473320
                                                                                                                                                                                                      Entropy (8bit):7.170882557492812
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:JrUM+KjQptQubmeGTU9taTqvyG0F/n2umcetnHaR:JKtQkmGc2Rcv
                                                                                                                                                                                                      MD5:207187DA1CFD94F8D927A6D6094A33AF
                                                                                                                                                                                                      SHA1:2BBCD15B440101F5781DB5F5178CEF8C0232CE3C
                                                                                                                                                                                                      SHA-256:BE964FA9736D7BDAD0C950FFF371197574A7081F488A884605C17010689CF877
                                                                                                                                                                                                      SHA-512:E3F32CA9805AE7267C399DEDC784E6A76A1A282A686490D02A32FFD39A719EDB49A3E07F7079709140A1EF3A21042267266A2D1F971881AC514D142F69D646AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D).t.H.'.H.'.H.''..'.H.''..'.H.''..'+H.'.H.'.J.'.0-'.H.'.0;'.H.'.0<'.H.'..<'.H.'.02'KH.'..,'.H.'.H/'.H.'.0)'.H.'Rich.H.'........................PE..L....."Q..........................................@..........................0&.......&...@...........................................................%.h.....$.4...0...............................h...@.......................@....................text...P........................... ..`.rdata..fL.......N..................@..@.data........@...`...*..............@....share..............................@....rsrc...............................@..@.reloc...n....$..p...:$.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\ExtNetIncrement.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):285048
                                                                                                                                                                                                      Entropy (8bit):6.492512091199515
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:As8yZny7jGBbSLPdSP3JBI6jsR8Pym0OSahuJ+:zy7SBb+dSP3JBI6o8qm0O/EJ+
                                                                                                                                                                                                      MD5:39E18F0F619546380688A92AF44D654B
                                                                                                                                                                                                      SHA1:76D6E5065F188EA287D00BEB8B2C38C4F9631038
                                                                                                                                                                                                      SHA-256:3C2FFF93C150BB229FF1B71E8720CC18DEB9B69B1A0FCBFBE691256EFF3DEE92
                                                                                                                                                                                                      SHA-512:B53339E2C940A38020C48F3F9FD3925168CD7ABFB6B974A4E80FB4762FA8A9A028638FC0D904F4A8D0065F50C0CE9672CEC3D945C9B5146CC8D13B7C712C157D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$..VE.HVE.HVE.H_=WHLE.H_=AH.E.Hq..HAE.HVE.H.E.H_=FH>E.H_=PHWE.HH.VHWE.H_=SHWE.HRichVE.H........PE..L....#`P...........!.....T..................p...............................@......................................@.......T........................D..x........!...s.............................. ...@............p...............................text....R.......T.................. ..`.rdata.......p.......X..............@..@.data... ...........................@....rsrc...............................@..@.reloc..:D.......F..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\defaultskin.zip

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):89232
                                                                                                                                                                                                      Entropy (8bit):7.804803823752292
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:y55kBo8le0jvUXLH7STim62VC1A58PblX1XzJxUn5ucRGcZRX4:y55kBoDeI/STBB2A0x1jJxu5VRGcZV4
                                                                                                                                                                                                      MD5:0AB8A06150CBB0561E907976715CB447
                                                                                                                                                                                                      SHA1:71ACEACA41CDB176D9E6CCE7856B44A3D39C573D
                                                                                                                                                                                                      SHA-256:F160C8EFA5A2D1F42216403DB162BF0F205C716A5FB96522D1A573C28031191D
                                                                                                                                                                                                      SHA-512:D5D787AAF97E764BB7EE226CE33EC765C308D27BC4FC4F18EE3A9A3BFD766E964D052BE854B1F418340E4657DB858AD5EA950DEB6C37A9FCDA70A3667E43CF8A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK...........A................default/PK...........A................default/add_link/PK.........aA...x............default/add_link/bk.png.T{8.{..Q3,M....Q.....!...}n-Ns'IL.$....g...!..en..Sn1+....4.5#.vv.8......}>.....}...&.,.$.%...B^3w...7..,.&.?[f...x:....~......].\.c..../U8`...[.6-.8%..q.9......C.#....yQ}......X.=.^.D.IIDT..s...(6u...t.!....l.......f....3..U.a.bq.Y...5....._Q..}b?.]....6sZ..++.^...F.........*V3....t.c./..?}R...9..H.<H1B ...'&..X.....G.U.Z_Jc.>.._.k&.$$$\v.\.g1.cOxe^......{-tF..@.1,[...D....,l......+p.J.r.]z.....sS,=..Z..`.^FCQ....&".........}..F4.....?..i.Z. .... 'E...s.....0.#...Q....(..........v.....F..e0<.T8p....q;.$\...L...u~.]x...4z/J%./.\_4..#Dz.?S...\.M.4@.O!9'....K.G.9zYZ...?.....-...O...i..Bah'..YvR..e n.;#C.K.pTck..{U.....7...j.;..4`%.....<........$D...".f.....2@q.Gh...3Y@.G.r...P.}...N..T>..F.i..).........<6..>z..U.QC.Lw].9....,.!l.y......k;{...w)s..\.]s/jD.f}.....3........'Hb.e.....W.Kp-T\...Z .s..?.KT.r.B....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\language\2052.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1592
                                                                                                                                                                                                      Entropy (8bit):5.57984884030076
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Q+jUY4lo0tGhjg4URnvJgCWaiJm1Nob6AdtT4si2OaaNoq26AdtuQyskB0uPTn0O:rjyosGhMhRnSCM6g472F6DMcvTn0O
                                                                                                                                                                                                      MD5:A4CAC1232C683C6F12FE77D7F18E8982
                                                                                                                                                                                                      SHA1:ABCB5A0E26260EEBC4A24753496358E0D6CC2BD2
                                                                                                                                                                                                      SHA-256:F6D12D2742F2CAE90B9CC1EB2A51C81F793EAED9B6E3E18439F00EC74F1C7D9A
                                                                                                                                                                                                      SHA-512:5DF6850EB4AE88F6C137FF33591DF74DBBF921C65A87A416031D5CBAA332217CEAEE45EEC7D7373A511D1BC80FD9E414DC87881C82576E82B654E98D72530443
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.a.p.p.].....N.A.M.E.=..mo`.vP[....L.A.N.G.U.A.G.E.=..{SO-N.e........[.M.A.I.N.].....1.=..`(u@..c0R............[.L.O.G.I.N.].....2.=..R}.-N..........3.=..f.e.e.l..c.N.g.RhV.....z.T..........[.B.U.D.D.Y._.L.I.S.T.].....1.=.._ZS}Y.S....2.=..b.vsQ.l........[.F.O.C.U.S._.L.I.S.T.].....1.=.@b.g.R.~....2.=....R}.-N................[.C.H.A.T.].....1.=..S...Q.[.N..:Nzz........[.W.E.I.B.O.].....3.=.#...(W....eQ.[IN...#.....2.0.=..b.v..u.....2.1.=..b.v._ZS....2.2.=.@..c0R.b.v....2.3.=.6e0R.v.......2.4.=..b.v6e.........[.M.A.I.N._.T.A.B.].....1.=.._ZS....2.=.@..b....3.=........4.=..y.O....6.=.sQ.l........[.I.D.D._.S.E.N.D._.R.E.C.O.M.M.E.N.D.].....1.=........2.=.l..S....6.=..S..1Y%....N...S.^..Y.v.Q.[....7.=..S.^1Y%......z.T.Q.....9.=..S.^.Q.[.N..:Nzz....1.0.=..Q.[*Y.....N.....1.4.0.*NW[&{....1.1.=.l..S._ZS........[.I.D.D._.S.E.N.D._.W.E.I.B.O.].....1.=..S.^.e._ZS....2.=..VGr....4.=..N/e.c.v.V.P<h._...N/e.cJ.P.G..0G.I.F..0P.N.G..VGr....5.=..N O.v.V.P._{..\.N5.M.b.....6.=..S..1Y%.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\_appdata_\360Notify\Bin\language\current.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                      Entropy (8bit):3.070031888400838
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:Q+elPVtClLtlElQalGn:Q+elqlxeldGn
                                                                                                                                                                                                      MD5:D45E9DDBE56A1DD7B58BD733BFE482B5
                                                                                                                                                                                                      SHA1:2C83B4D3CB08F08D1C3545FF50AE14F0B49A58DB
                                                                                                                                                                                                      SHA-256:52989F602299162773D8814D10C6A5A45FA86B4BDADF7295FFBA816AFE04CD32
                                                                                                                                                                                                      SHA-512:D24A4D96458E103B51F5A23DE3528DBA1BA216692870B1E4B41625BB0D7EFBAAEA5B8BC2A90E6CE25C14408F2B90A0EADDEEF45356E1EDB07A964AC04818F87A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.a.p.p.].....l.a.n.g.u.a.g.e.=.2.0.5.2.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\360Inst.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):894360
                                                                                                                                                                                                      Entropy (8bit):6.50736456481616
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:AflY25rYtl8e37Hgtry9Aaf31szCm5sktTWOW:ao5rAtuz31s++TnW
                                                                                                                                                                                                      MD5:7F485B9E043A2B95100E34D80F0AB72A
                                                                                                                                                                                                      SHA1:6B1AD0635BCA33E1A68ECC0F8945DF34A03B8F6F
                                                                                                                                                                                                      SHA-256:21A1ED802E6896AFC13692D4A66E48EF6C1C80C1EF91246703CC5529D3B21FD7
                                                                                                                                                                                                      SHA-512:5C900E97606D3177A24C3DECB4338544B4E1CB4D454DF3B91DC6CDD6BF2B68725A587B0237101674447B813D689942481F83918F5378AB21B76449DACA330717
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........WW".69q.69q.69q&)3q.69q.*5q.69qM*7q.69q.)3q.69q.)2q.69q.)=q.69q..3q.69q..2q.69qM>fq.69q.>dq.69qM>dq.69q4. q.69q.68q"79q.9dq.69q..2q.69q.0?q.69qRich.69q................PE..L......M..........................................@.................................m...............................................@..............@...X............................................................................................text............................... ..`.rdata..............................@..@.data....=..........................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\360TopbarASS.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):256872
                                                                                                                                                                                                      Entropy (8bit):6.339631168221611
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:3Xb99IZWz+PsND5nraXUrKronKAQLU/3PnXWvobxuaL5RVapOnTgVAO:HTVC0YUzKAQLE/nXR4pnAO
                                                                                                                                                                                                      MD5:DEC58427DAFCCF050DA9AC893E28407C
                                                                                                                                                                                                      SHA1:402F223A05C6CA83E961DCDA7FAEB7EDE7A37AF5
                                                                                                                                                                                                      SHA-256:F007E20E10ACC6BC15A5890961BC9D971D43BC004E685C6B32F7A2261C20A7EB
                                                                                                                                                                                                      SHA-512:DAB9B0CF62E65B48FFB018DD37867ED02650F0ADC1800110845030404C421BDBFC58FC2711C306963FC5FBDFFE29E4B99F38F277E8CC601FF9267848FD9A5951
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o.f.o.f.o.f.H=..n.f.f..x.f.f..S.f.f....f.H=..|.f.o.g...f.f..k.f.q..n.f.f...n.f.Richo.f.........PE..L......Q.................h...l.......#............@..........................@............@..........................................@..`...............h........... ...................................@............................................text...1g.......h.................. ..`.rdata...b.......d...l..............@..@.data...|@..........................@....rsrc...`....@......................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\360wpappInstaller_zhuomian.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1746672
                                                                                                                                                                                                      Entropy (8bit):7.994118615758001
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:49152:qQQgSWLXONX2QQIxDZcn/tAFKtJcMEhnmAr5ZS2VfP:qcverZ4BXcBm83S2VX
                                                                                                                                                                                                      MD5:02C91D3BE856789E1711C37649F382CC
                                                                                                                                                                                                      SHA1:6FE184CE5D2198CBB6CCFF37BCDE5F9950BF9ECE
                                                                                                                                                                                                      SHA-256:26286D2C63A0DF39CDDEB780B626D807C92A0B071D9C313010F24692BD98E2A1
                                                                                                                                                                                                      SHA-512:A2279790AC31A0DC625CE0390EA2F33C8AD1ED125F2862A46117EF94830FAB66A92D76B8F49F6B8284DB9F306E2F9B4835A728BE381FF6FE126D52228D02AA0E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................P......&/.......................................s...........G..........@................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....G.......H...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\GBInst.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1412584
                                                                                                                                                                                                      Entropy (8bit):7.990098245004688
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:24576:XbduHjw+g0xZXPga+rRrh0C1hgptkWgq9UHluMqs5/JsB23egfPti:XbdGw+guZ7+xhrhEFgquHz/k2Ogf
                                                                                                                                                                                                      MD5:32DC2FA6DB8B8809B12A8CAD215C69FD
                                                                                                                                                                                                      SHA1:0C6232CDEE1976179AF0C0CD9CF7E7A07D1F4C42
                                                                                                                                                                                                      SHA-256:1FE187BEE814736553B90DED2581060F2AC5A81950876CD9418CF352DD236FE9
                                                                                                                                                                                                      SHA-512:10B9467BEB0D71C41BBD487CAA6714CBFE519CA767792E029D39CECEBD660CE16E4DB6833BFD8370EC5628CF83BEB6E5E31C5966997D192895C7485A335C9C4A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................0...............................................s...........E..........8s...............................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....E.......F...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\modules\SwitchBarCloud.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):494
                                                                                                                                                                                                      Entropy (8bit):5.057595445515239
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/WgsZLr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/K/Xe/JEm
                                                                                                                                                                                                      MD5:5A3EE026FF55F8DD65A26FBC186FD5DB
                                                                                                                                                                                                      SHA1:EEF2D54C1A38091E8D61F9BF5B9F4715946D6EC2
                                                                                                                                                                                                      SHA-256:86EC857FD7844036CABE640AB49F92784C9225463413FFE1B406F2FB80772372
                                                                                                                                                                                                      SHA-512:376E27A5D2DCC391A5C85A51518BBFE2559B72107AB05D0068E04928247688887D56FBED60A19429001B4FC870FF5C6F8914464277E1EA6AFAD63DC3F83F3359
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1003" Enable="1" Visible="1" Image="topbar_cloud_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\safemon\urlproc.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):87456
                                                                                                                                                                                                      Entropy (8bit):5.616444162790961
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:iBIUl8MFxhYIvPhYOccxJn8ep+rH4DsSbsIJsZLWpx4ZsbcPMtiLlo5k0nApWsO7:iqUlbhR9cA+zE1f4HMtykCFzTb0wCac
                                                                                                                                                                                                      MD5:8CE736CAEE5625DF6D0699D5F1924887
                                                                                                                                                                                                      SHA1:4D165E5D265FE185754A6D4555826FF8A61721E1
                                                                                                                                                                                                      SHA-256:7C2CCB4129D2263EE40BF92855D5C0325A666B2A87D8661E8621B24BA49563AA
                                                                                                                                                                                                      SHA-512:D934CD27BB7C1A08D94BEDAA20A73C184CDCBF20980EA823CB9A52583D138049B66F7D6086849C82A67873154B2A7017A962895C4E39FC66F47A99F2EB4A2870
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\2...SlB.SlB.SlBcO`B.SlB.ObB.SlBwLfB.SlBwLhB.SlB.ufB.SlBwLgB.SlB.[3B.SlB.puB.SlB.[1B.SlB.[1B.SlB.SmB.SlB.ugB.SlB.UjB.SlB.shB.SlBRich.SlB................PE..L....soM...........!...............................e.........................P..............................................@........0..(...........H@..X....@..l...0...................................................(............................text............................... ..`.rdata........... ..................@..@.data...T0.......0..................@....SHARE..0.... ......................@....rsrc...(....0....... ..............@..@.reloc..l....@.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\safemon\urlprocnet.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):136616
                                                                                                                                                                                                      Entropy (8bit):6.32770736826905
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:V6TQZc+yVXGmXAdP3ubBxFY54fPj0RJfgxVR:QTQZcXWD+JY54Yfg3R
                                                                                                                                                                                                      MD5:542ABB59D9A55F1B1A615042231FBCAA
                                                                                                                                                                                                      SHA1:32025169D4AC25971E96DD59173CA585A776DC8E
                                                                                                                                                                                                      SHA-256:52C344CA31F055D1C3B87FEE17262B84A1B329F14780A8CA62F8A5B4D0DB85E2
                                                                                                                                                                                                      SHA-512:BB29081544453316FB173D37F17B61D6C37E186780A34BCCF90060BB12D67A9B54E7B886121B75183945B5D60BF00EE29205C2F39F17B9E10A9DCA699FF1BE31
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..................z.....z.....z............................#....#.....................Rich...........PE..L....apM...........!.....p..........Q..............e................................?...............................................................P...X...........p...................................................d............................text...(o.......p.................. ..`.rdata...0.......@..................@..@.data...\........ ..................@....rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{9B58E929-A6F0-4dc9-BD76-266767E35DAA}.tmp\wftest.tf

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\360Preview.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\360Preview.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\360desktop.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\ACS.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\TopBar.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\deskrule.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\feedback.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\processinfo.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\softdt.dat

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\softsignore.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Bin\weather.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Config\config.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{A65372C3-C49A-4cbc-81A4-8F3203B8ED63}.tmp\wftest.tf

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\updatecfg.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):12216
                                                                                                                                                                                                      Entropy (8bit):5.54645724919143
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:/UQRSd7LSaSwSlSiSQSGShSWSBSfSwlSwZSw4SPS4SZSjSQS2SwVGR2J5m2I3vFv:MQOXwRxlvFazbyb8Y8lWJaHXeScpbGs3
                                                                                                                                                                                                      MD5:E18B7A43121B67302212B4DA5A84CFF4
                                                                                                                                                                                                      SHA1:01AD7D463EDB0F2D94DE9817D46AE9240A8E9706
                                                                                                                                                                                                      SHA-256:F046B1F00384DB55B6BBC5360CA3DAE9A3CEA4212A4CFD4E6C1DC06C7DF3D6C3
                                                                                                                                                                                                      SHA-512:2FF86333671B783B332CE92FE5721BABB1F9ECFB794FF906D36628B373B04A98760A0A86BD7D921EB0C8ECA290263E0EA981C8E2E0695E3714E8E8750B31953C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[wallpaper-cm2.swf]..ver=2.6.0.1040..path=C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf..md5=C49D014473AA8C4265DF5F40E10582E1..[mhead.jpg]..ver=2.4.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\mhead.jpg..md5=21F120093FDEFB193952E0ACE4066C25..[Skin.jpg]..ver=2.4.0.1020..path=C:\Program Files (x86)\360\360Desktop\Config\defaultskin\Skin.jpg..md5=5D1059252A64312D62181DAE70A16EDE..[wallpaper_ext.jpg]..ver=2.6.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext.jpg..md5=0ABD919C48DC87BA83894DE37F59168E..[wallpaper_ext_cm.jpg]..ver=2.6.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_cm.jpg..md5=C252183A655AC31D68FAC62B2EFBE9DA..[wallpaper_ext_disney.jpg]..ver=2.6.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_disney.jpg..md5=4E590ABBCAF2E93A86D82967DB90C3D2..[CloseMenu_Icon_Hibernate_Topbar.png]..ver=2.6.0.1110..path=C:\Program Files (x86)\360\360Desktop\Bin\skin

                                                                                                                                                                                                      C:\Program Files (x86)\360\wftest.tf

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360????\360????\360????.lnk

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu May 16 09:01:18 2013, mtime=Thu Dec 28 22:21:31 2023, atime=Thu May 16 09:01:18 2013, length=206000, window=hideshowminimized
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1311
                                                                                                                                                                                                      Entropy (8bit):4.619081043965708
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:8m5svEYdOE3ClOlPyABqEGdBmYdBmUUxhHPqygm:8m5sMYdOUCIPR0JdsYdpYRyyg
                                                                                                                                                                                                      MD5:3B00591282A0C6F52FED7429F5EB3A8B
                                                                                                                                                                                                      SHA1:A1D5AA1741FDD83CA87384CDD02B5E627AD277E4
                                                                                                                                                                                                      SHA-256:5DD7080B22256FE18093CA5AE44CBF4D1C48195680E1D5A7B9CC00B0E1FAF499
                                                                                                                                                                                                      SHA-512:4E491F1847DFA72A3CC04A29E822BBECD944B85CCF8C82FB208B7B1336B3C9FE3619EAA3BC896464B35DD3BF2EA93AE0670D88759D3B887E6A2C0600BA843A82
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:L..................F.... ....$0O.R.......9...$0O.R...$......................!....P.O. .:i.....+00.../C:\.....................1......W....PROGRA~2.........O.I.W......................V.......+.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W....360.8......W...W..............................+.3.6.0.....^.1......W....360DES~1..F......W...W......;.....................y...3.6.0.D.e.s.k.t.o.p.....J.1......W....Bin.8......W...W.......S......................i.B.i.n.....h.2..$...B*P .360TOP~1.EXE..L......B*P.W.......V.....................4..3.6.0.T.o.p.B.a.r...e.x.e.......f...............-.......e...........i.......C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe..I.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.\.3.6.0.T.o.p.B.a.r...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.........*................@Z|...K.J........

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360????\360????\??360????.lnk

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=1, Archive, ctime=Thu May 16 05:12:31 2013, mtime=Thu Dec 28 22:21:29 2023, atime=Thu May 16 05:12:31 2013, length=1146032, window=hideshowminimized
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2109
                                                                                                                                                                                                      Entropy (8bit):3.4967883806399165
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:8QMYdOUCewioJddhNdj7ddhykdh4YCryg:8y5wnh3hysh4Jry
                                                                                                                                                                                                      MD5:FE2E8FA6C14B9E7C6561B70ED74C2316
                                                                                                                                                                                                      SHA1:E98B7C1A374E5F9521112D34401743F4146EF296
                                                                                                                                                                                                      SHA-256:6E10C620FAA14DC0E264F7DF464EE9504059DB266059E4063BC71EEC155019F7
                                                                                                                                                                                                      SHA-512:6098CCB2502535918FE5AA05D82DEC66B0A835548A2A36AC36DB72B98274D2AA79CFC051CDBE3E444C47D8C5DC7430F5BB743656CC25E5BDD22035A64AFB2954
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:L..................F.@.. ....z1Y.Q..y.k..9...z1Y.Q...|...........................P.O. .:i.....+00.../C:\.....................1......W....PROGRA~2.........O.I.W......................V.......+.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W....360.8......W...W..............................+.3.6.0.....^.1......W....360DES~1..F......W...W......;.....................y...3.6.0.D.e.s.k.t.o.p.....h.2..|...B.1 .UNINST~1.EXE..L......B.1.W......2V.....................M..U.n.i.n.s.t.a.l.l...e.x.e.......b...............-.......a...........i.......C:\Program Files (x86)\360\360Desktop\Uninstall.exe..E.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.U.n.i.n.s.t.a.l.l...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.U.n.i.n.s.t.a.l.l...e.x.e.........%ProgramFiles%\360\360Des

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360????\360????\??360??????.url

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows 95 Internet shortcut text (URL=<http://zhuomian.360.cn>), ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                      Entropy (8bit):4.621115365169273
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:HRAbABGQYm/5bEMfn:HRYFVm/5bEw
                                                                                                                                                                                                      MD5:88E53DE9C4AA586069BD33FBB8BB7DE9
                                                                                                                                                                                                      SHA1:9A550ED0BC829B88A51024C5CE340DFBE2BFD8F5
                                                                                                                                                                                                      SHA-256:9A970857EE0C2BBAA89C0DDCE46A9791B1FCBF0599518DBDD8C4A48A815471A2
                                                                                                                                                                                                      SHA-512:979C74655B3CC6E6738694A4BB398C265164083674AEE11A77B43355E2439A3FA32B24AD6D1CB90192DD5DAA963CB0B0E4B16AB82497CB2AE7AF0F5C04E82E0F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[InternetShortcut]..URL=http://zhuomian.360.cn..

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_62339874224de82a9abd3a937b2fb56c25ae5117_f78a65ed_a168f718-059d-4515-b66f-56441669080f\Report.wer

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                      Entropy (8bit):2.398021602915379
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:Y/UFxCmfvfbaujA2Eon5ERJ0UsFJzuiFlY4lO8k:Yix7vfbaujMo5+JlsrzuiFlY4lO8
                                                                                                                                                                                                      MD5:07E14445383AD70AE7F4FEAF7D1A6675
                                                                                                                                                                                                      SHA1:D3CD45DFEC7675CC56EC14C16BC788D7D59B6F07
                                                                                                                                                                                                      SHA-256:7CCC528B31759537D28540C1DD4A31B6135047C84AE013A11DEC6EC4C5A82A22
                                                                                                                                                                                                      SHA-512:80A88B2E868728AB25846C65188DDC2980AFBC73191A37EC9578F360EF07890CD9EAEFA4094F0F70C9F3A9EB88B2E660D87B8563D0C3EBED8A5BFC98BE26F831
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.8.2.7.9.2.5.5.2.4.9.8.2.6.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.6.8.f.7.1.8.-.0.5.9.d.-.4.5.1.5.-.b.6.6.f.-.5.6.4.4.1.6.6.9.0.8.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.d.e.2.2.9.e.-.1.a.8.6.-.4.f.c.6.-.a.f.b.e.-.2.7.e.e.f.c.f.a.7.3.3.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.E.x.p.l.o.r.e.r...E.X.E.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.f.4.-.0.0.0.1.-.0.0.1.4.-.d.c.2.e.-.8.7.0.3.d.5.3.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.0.b.0.8.0.e.0.6.5.5.7.2.0.c.a.d.8.c.1.c.a.e.4.b.8.1.9.3.c.9.3.8.2.c.9.a.c.9.2.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.2././.1.2././.2.1.:.2.0.:.5.

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_dd5d7afc3acb40f4e777363425aedd5e74273_07ad8ade_96316a93-0571-4c1b-934c-b292833c1c85\Report.wer

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                      Entropy (8bit):1.74924789358102
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:k2n5MCufvfbauj1Z+r3bwtRIzuiFlY4lO8k:Fn5MLvfbaujyrLCIzuiFlY4lO8
                                                                                                                                                                                                      MD5:AEBC0B803731E6ABFFDC3F5060409AF5
                                                                                                                                                                                                      SHA1:66E89178DF920E0AD36197DD205065E5AD07CC5B
                                                                                                                                                                                                      SHA-256:AE340280835597EFE31D9DB899F7581E95F748BE7BCF05BD94AD6F402D31F503
                                                                                                                                                                                                      SHA-512:1D47082F59C161C6F61BB594CAE5FD27B37409EA29D24A26C5ED5A4942A9832346F9846E72B2F09F95EAF4F0463CCD512BD8BDFE09A92A8D52580181E3AFAFF1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.8.2.7.9.2.6.5.5.3.0.5.7.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.6.3.1.6.a.9.3.-.0.5.7.1.-.4.c.1.b.-.9.3.4.c.-.b.2.9.2.8.3.3.c.1.c.8.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.d.a.6.9.c.a.-.3.5.8.0.-.4.b.0.9.-.b.2.1.6.-.9.e.a.5.1.7.e.c.2.c.7.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.e.x.p.l.o.r.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.a.4.-.0.0.0.1.-.0.0.1.4.-.5.a.a.3.-.f.1.8.2.e.4.3.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.0.b.0.8.0.e.0.6.5.5.7.2.0.c.a.d.8.c.1.c.a.e.4.b.8.1.9.3.c.9.3.8.2.c.9.a.c.9.2.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.2././.1.2././.2.1.:.2.0.:.5.

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C56.tmp.dmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:Mini DuMP crash report, 17 streams, Thu Dec 28 23:20:56 2023, 0x1205a4 type
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1099374
                                                                                                                                                                                                      Entropy (8bit):1.4705112137526222
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:/zd1LlbsRnvpSyKBeFSmX7C7m9BYSDJwy:/zXL9U
                                                                                                                                                                                                      MD5:5CFF05927F8579D599F170E382D64EEA
                                                                                                                                                                                                      SHA1:75A0081D1D3C69386C65BFD1F0281CC4A1F6D6D7
                                                                                                                                                                                                      SHA-256:C4CF5EFB2D50BC42984026C1BC86BCAAF2F67B898C028F6B3C91D817C820D905
                                                                                                                                                                                                      SHA-512:BC0CCF1C60763A22060440F9766C411586E453076A3B7716DB52F7C407E7C5363DB6882681AEBB0C8EAFE5F6F693FC0E801EFA4ACA331BAB273F9DA346AD2B3A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MDMP..a..... ..........e................ ........q..........,...0...........\.......................x.......8...........T...$.......h....4.......... ...................(...................................................................................eJ.............Lw......................T.............e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...............................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER9233.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):10784
                                                                                                                                                                                                      Entropy (8bit):3.706375331166114
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:R6l7wVeJCpiT6YSq2gmfq1bDprF89bwWaRPmuf0YQm:R6lXJ8iT6Yn2gmfq1IwLRPmufT
                                                                                                                                                                                                      MD5:49EE29EE1AC27FB56659C859E521E9B2
                                                                                                                                                                                                      SHA1:046C1F061530AB452E3282A8C2547C745D5C80C5
                                                                                                                                                                                                      SHA-256:6F622E724CD4D1895E682C95E7C020352ED354E67A2FC32E48537C178693467A
                                                                                                                                                                                                      SHA-512:56AA8B996A186AD52EAFF02A9E92E15DF49DBCE8CB5F34E3E5C2CE95F2E168D152607FE42A0B0FA2599E4AC25A66F7AF21A94B5F26B387D3A109193F5899DBDC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.8.4.<./.P.i.

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER9282.tmp.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4728
                                                                                                                                                                                                      Entropy (8bit):4.468376829716708
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:cvIwWl8zsFJg771I9FSWpW8VYbYm8M4JYtqFEjyq85Xxyg5b9Q32d:uIjffI7Oz7VzJA3op5ba32d
                                                                                                                                                                                                      MD5:3913426649A64465D820A0B2EB2A5F5F
                                                                                                                                                                                                      SHA1:209823C5AFC5C153B93E688A798EE4C09656618B
                                                                                                                                                                                                      SHA-256:287B467310DF4BC630A7E6FE027BFB8209D77097F5F1E23FBE418DDB3714EBAB
                                                                                                                                                                                                      SHA-512:DFE12BF845E83D0471862B6841FACA1F048250D5E755B007F9A464232EA41229B3D9E02417C99E8482C6A7709A195D84A686AD175C9D8EA5818531F5AE47CE4F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="124703" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB47F.tmp.dmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:Mini DuMP crash report, 15 streams, Thu Dec 28 23:21:06 2023, 0x1205a4 type
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):678118
                                                                                                                                                                                                      Entropy (8bit):1.5935665044987075
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:1nT4iW6cxdQgELinR0thF/Gfe3UnSng6kS64pgZ:1nTrW5xbnR0HQOJN6l
                                                                                                                                                                                                      MD5:41BBCA5E0EB28C2D2E5AB13A5E6C8B6F
                                                                                                                                                                                                      SHA1:980F32DDA255278CB5B756A0F5F9982B040DA0D3
                                                                                                                                                                                                      SHA-256:A2F94309C3C67D6B3B33495B5CAA83AE5D62DF7CB3A6BB52AC941820847A5ED6
                                                                                                                                                                                                      SHA-512:2545730EB1D4551E55B41608EE7D6AEF5A4494408C4648AB3E1DC5F78C2A7713AC2F3EF0693989B00092AB5243CA9B1DF5EB285023DB56B3C176B89C96D4DF94
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MDMP..a..... ..........e.........................E..........$...hT......d...>9..........`.......8...........T............................T..........xV..............................................................................eJ.......W......Lw......................T..............e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB78E.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8216
                                                                                                                                                                                                      Entropy (8bit):3.7278727623440653
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:RSIU6o7wVetb+7fcg8BYtc1z5RutgaM4U3q89bIb+hpPPdRpPPdDpSPNpgppp0pz:R6l7wVeJ6fWYq1bDpra89b0+VfM8m
                                                                                                                                                                                                      MD5:CABB11AA5F894F07146AA5F03D58580B
                                                                                                                                                                                                      SHA1:E15DE4168B88420127CB5B250368CE9A5F4D87B4
                                                                                                                                                                                                      SHA-256:B2782624FE1CAB2084DA2250079B5F0F4B37DE6A35760A8C9A08BA23C81CFB68
                                                                                                                                                                                                      SHA-512:196070B75380AB8BA1661E371596E10B657A7CBF1B280538717A1C32826F8D6A8BD4215E8C328FFC4CB5440D2DA63AD148A432CF77C736280B86B61C1B6C01A2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.4.8.<./.P.i.

                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB7CD.tmp.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4729
                                                                                                                                                                                                      Entropy (8bit):4.457435373305323
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:cvIwWl8zsFJg771I9FSWpW8VYcYm8M4JYtqFvyq85Xx7Ub9Q38d:uIjffI7Oz7VoJAkomba38d
                                                                                                                                                                                                      MD5:28B3533A91C34B21C595FB036B9F74D4
                                                                                                                                                                                                      SHA1:B1B3E6DA39AFC22ACF75B3CDFB27FFAECC48287F
                                                                                                                                                                                                      SHA-256:24A8FEB67FE7BF718E8B3DE5D0F586620DDEEE41EB137323A10EEC43AC15D875
                                                                                                                                                                                                      SHA-512:E4F3D06074CDF6FB56C466C2D5769B69BF4E70A6A4918FD26D4BB32580ABDA515A0EF5893BB324F63C101D1E55F79FC24AF846B4A50D710302675A5BCD535DA7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="124703" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                      C:\Users\Public\Desktop\360????.lnk

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu May 16 09:01:18 2013, mtime=Thu Dec 28 22:21:29 2023, atime=Thu May 16 09:01:18 2013, length=206000, window=hideshowminimized
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1287
                                                                                                                                                                                                      Entropy (8bit):4.631573310951419
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:8mWsvEYdOE3ClOlPyABqESdBmYdBmUUxhHPqygm:8mWsMYdOUCIPR09dsYdpYRyyg
                                                                                                                                                                                                      MD5:EE8C838DDF9B9956E8980243DE82E819
                                                                                                                                                                                                      SHA1:FC740AB824A2DA0779B6C29D3156F8B389802B34
                                                                                                                                                                                                      SHA-256:1E7BAFED1310C9832FFE5AB69B4CDCCC3CD06A2E7522796512AA82F819AF9072
                                                                                                                                                                                                      SHA-512:5038AED34ECE77AE308850231D8A8E1F738CFD88A74D5DF7A175A2BA279B66871445D60C5F0947DCBF70A2419C988C64F977EA429B032B5ACBD2F1D1ED67CBC4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:L..................F.... ....$0O.R..& ..9...$0O.R...$......................!....P.O. .:i.....+00.../C:\.....................1......W....PROGRA~2.........O.I.W......................V.......+.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W....360.8......W...W..............................+.3.6.0.....^.1......W....360DES~1..F......W...W......;.....................y...3.6.0.D.e.s.k.t.o.p.....J.1......W....Bin.8......W...W.......S......................i.B.i.n.....h.2..$...B*P .360TOP~1.EXE..L......B*P.W.......V.....................4..3.6.0.T.o.p.B.a.r...e.x.e.......f...............-.......e...........i.......C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe..=.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.\.3.6.0.T.o.p.B.a.r...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.........*................@Z|...K.J.........`.......X.......226533.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\360P2SP.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):724600
                                                                                                                                                                                                      Entropy (8bit):6.515371619339392
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:xnFslNsHuR4pg6uEBj/jRK5nYg2DNfMC+zFXTX94/wo9Tm5KO1f:5FslNsO6yft2JfMjzFXTt4V9To1f
                                                                                                                                                                                                      MD5:640F33B0059ED6EB89AA5133263846D3
                                                                                                                                                                                                      SHA1:F1BC1491BBF6DAEC1FB2B1AA3437BBA4C3D3D0BA
                                                                                                                                                                                                      SHA-256:677C9F6A9DF66F0F086931AD46B28B4C94BFF7A28960B8E9970B84801D633AD8
                                                                                                                                                                                                      SHA-512:14E3A419C0A75B3780903889A0D4921AB7487ECF53272C10042DB4D211D15C226A10CF8C25AA23E143EBFE77C15A7A9D6FAE3BD2F4EAA5A701295A8AA6405313
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^i..^i..^i..y..._i..v..Vi..@;..[i...&..[i..W...~i..y...Ci..^i..i..W....i..W...*i..W..._i..@;.._i..W..._i..Rich^i..........PE..L......P...........!.....v..........<Y..............................................-.....@.........................pX.......D..,....0..................x....@...S..`................................................................................text...,t.......v.................. ..`.rdata..B............z..............@..@.data...@....`...:...F..............@....rsrc........0......................@..@.reloc...q...@...r..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\360net.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):275288
                                                                                                                                                                                                      Entropy (8bit):6.682710718683491
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:Xxn20OeU6F/uixt2soJiM3EbmaOCs8WgNeDuctl4dzNQvB2YEGw069uK309tM0Xi:XJRUih2sevZsNeaVzSvBbX6019taPE
                                                                                                                                                                                                      MD5:E6FF763A4AC91232979560525E12E4C3
                                                                                                                                                                                                      SHA1:366D43F4C049137114FE0D72F84547632A399DD4
                                                                                                                                                                                                      SHA-256:250BBC73FECDA4023E52D0D07FB3B77889D4D20BBEA55C59304237F0A1D5F763
                                                                                                                                                                                                      SHA-512:2DBD3ACEC39CF7559DD22DF8F2EB2B1B5AE31D65599E3327F7910F375F10A49B7E6AC0A714A1C8D492D33CEFCC8955D5BE6D3AF7BE71B3BA94E54B5AA1437EC9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<.....w.<...G...<...=.y.<......<.......<.......<.......<.Rich..<.........................PE..L...{..O...........!.....f..........;...............................................................................0...z...|........@..h...............X....P..H .................................H...@............................................text....d.......f.................. ..`.rdata...s.......t...j..............@..@.data....6..........................@....rsrc...h....@......................@..@.reloc... ...P..."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\360verify.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\7z.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1143104
                                                                                                                                                                                                      Entropy (8bit):6.908541805805633
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:M7rMZ9VnpbFmR3Wjih7gK3FNhAuqtqo40gu9xZu9xZoPyL7:8rm9VnphmQihVhAuYqo0u9Xu9XNL7
                                                                                                                                                                                                      MD5:8DD4CE4D5EEE031135A64117731F0187
                                                                                                                                                                                                      SHA1:139CB0851FDFEF952BC80307F22B9132B941F64E
                                                                                                                                                                                                      SHA-256:428A0546DCF68A9ACB6A2CDC6082168652E3D315493230D06C80102BD3D09B1E
                                                                                                                                                                                                      SHA-512:1930E581329EEC9B64AE1949AE84563E3F247C7AFF5622ADDB289D1630FB3364BF295CD1D610207D6B5BBB5FCEEC951614AEC9CA8DA4687333BA706D96D9E757
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..6...e...e...e...e...e...e...e...eM..e!X.e...e!X.e...e...e...e...eP..e...e...e...e...eRich...e................PE..L.....Q.....................t....................@.................................e.....@....................................,....P...............R..@....0..........................................@...............(............................text...:........................... ..`.rdata..P...........................@..@.data............<..................@....rsrc........P......................@..@.reloc..T....0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2015408
                                                                                                                                                                                                      Entropy (8bit):6.301459019627537
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:fxHf82WTNblrzv1I3pF4HYvMFkzFqv+IFPpds07XTuG+W40oS7B7L9xZY00:fxE9I3H4YCdpz7DuGvoGB7L9XN0
                                                                                                                                                                                                      MD5:F20C9B80E5D66E079E4350A1BA0F6295
                                                                                                                                                                                                      SHA1:1379EE0823F1B3284611B20F079CC7679C5B4FCE
                                                                                                                                                                                                      SHA-256:7764AABF7B2B1756980BEEB384A63106841188DC03A9EDDB79F8F2FE451B8757
                                                                                                                                                                                                      SHA-512:8B8608B1B318CF63D86AD4CD66BEACE9A0F294E9F986694B9DEB8C7A3338EFA05F8A0714A9EF6CCAE1384DE0452B29C603421AC00ECB1A489D6EEFC0FB6077B8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V.........w.S......P......A......F.u....~.......~.............A.......O.N.....Q......T....Rich...................PE..L...v2vQ.................t..........R.............@.......................... .......5....@.....................................|....`..Dn..........................................................H#..@...............t............................text....r.......t.................. ..`.rdata...............x..............@..@.data...d........Z..................@....rsrc...Dn...`...p..................@..@.reloc..hK.......L...Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1113016
                                                                                                                                                                                                      Entropy (8bit):6.641503286094176
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:+uGlpBgDHNQqYIWG5fsuHycQExuZe1g1ZOjCtg3mWiH95t4ElF:+uGlp+hYIWewcQ7e1g1KCOmWo5t4ElF
                                                                                                                                                                                                      MD5:4683D7FE36DA34D5C875615C63A780E7
                                                                                                                                                                                                      SHA1:9B8E25F57E5F2593EE27A2623571D0838B61E59D
                                                                                                                                                                                                      SHA-256:DECD4A9179E0532E02DA7283CFBEFD4F672899AE23F663F1CB40D41119A5FBEA
                                                                                                                                                                                                      SHA-512:ADEBEA3659220F22708810F5CB23007EF731E67CCE3EA48D3DE267D9B2A5DE12B1C63120DF302E299CA4E43AF3024A4AAD6E433B4F2C8CDADD0E86759D0F218E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........txi...:...:...:.m.:...:.m.:...:.m.:...:..{:...:..m:...:...: ..:.m.:...:.m.:...:.G.:...:.m.:...:Rich...:........PE..L....~.Q...........!................\........ ...............................@............@.........................p...3...t...T............................p......p&..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...Hz.......B..................@....rsrc...............................@..@.reloc..Z....p......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):229360
                                                                                                                                                                                                      Entropy (8bit):6.679890430785069
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:RF494g2HDCpxH/cmBYpDIhjISo9TBVLnW/Z:Rm9OCHfcmBQnSo9TG/Z
                                                                                                                                                                                                      MD5:68A3D19BA62C6987E88CB2B7712B9592
                                                                                                                                                                                                      SHA1:E9B1C288165D09F2B0833719F7626FB39F96D350
                                                                                                                                                                                                      SHA-256:7893BB10C4291D70A48CDC3C65BDAE5D9DFE15DD3F84856CDA6A5A4E51EAAC09
                                                                                                                                                                                                      SHA-512:9A84096D56FB0C99A70BE69361FDF5F1ABE4583CEE4CB51FF12EB474CADF3CBD961952C6E78425E544F145A1FE8104B4E044ACC71A03BB30BD1A9C655E413842
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)..H..H..H..0O..H..0Y..H......H......H..H.$H..0^..H..0H..H...N..H..0K..H.Rich.H.........................PE..L...B..P...........!.................@....................................................@..........................!......d........p..\............b..........(..................................8...@...............t............................text...m~.......................... ..`.rdata..\...........................@..@.data....1...0......................@....rsrc...\....p......................@..@.reloc...+.......,...6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):642920
                                                                                                                                                                                                      Entropy (8bit):6.282990832147541
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:5qBB65rJHvhc5gWES4bpbDBCWSul20XW6+MSP95HiVNT3yUO5VZPIxT2AdhWXhlG:7rYUbpnBCWSGP2AWXh5569l
                                                                                                                                                                                                      MD5:C9DCDAE63FC4BC3BED7298E7C6FB3D15
                                                                                                                                                                                                      SHA1:F573C038E3E005172F475FD4EE805060926BA3CD
                                                                                                                                                                                                      SHA-256:468A1EB791002CFC420EBF42DF8D9F07DD345B630584D30A74305EA0F0F62329
                                                                                                                                                                                                      SHA-512:2AC67254AFB1F12C8723FC031B95E73F8F07F15E2781CDFBDB03EB0C5D78CEEA47A52AD8864E3B7A488E96EC13B926F20265CB811F04F6F51A45E9E9A1E1A060
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S..S..S..t...R..M.n.V...|.R..Z...I..Z.i....Z.n....t...\..S.....Z.`.~..Z.x.R..M.~.R..Z.{.R..RichS..................PE..L.....%Q...........!.....H...p..............`............................... ......-.....@.........................`........t..x.......................h.......tT...b......................H...........@............`..l............................text....G.......H.................. ..`.rdata..."...`...$...L..............@..@.data...8U.......4...p..............@....tls....I...........................@....rsrc................B..............@..@.reloc..Ds.......t...H..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):253616
                                                                                                                                                                                                      Entropy (8bit):6.269768372575183
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:Luf0V9jblulC9FT2saGG1VLErK2RaqOv+TBRjp3L:Hug9FT251Vz2cqOv+TdL
                                                                                                                                                                                                      MD5:5DC6B9FBC85018A912A166C5B7C6515E
                                                                                                                                                                                                      SHA1:51DE39B4CBAF5F704464EF43FD89099D96A540B4
                                                                                                                                                                                                      SHA-256:BAF48D4858CF440C64A617EB6FB0DEC7FA821A7136DA9D89A2FDE43CF09EB95D
                                                                                                                                                                                                      SHA-512:A4FB4EBD7E5DD00C3CDC86A0F11100623348E57218DC417D55F625FA0EDF144971E39B60A040684241F6F4FE13D68397AC8F47D251F677A1E3A51098A4235433
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xzq.xzq.xzq.q..lzq.q...zq.q...Ozq._...wzq.xzp..zq.q...fzq.f(.yzq.q..yzq.Richxzq.........PE..L....Y.Q.............................+.......0....@..........................0......@-....@.................................L........0..@............................2..................................@............0..<............................text...o........................... ..`.rdata..L....0......................@..@.data...@I.......,..................@....share....... ......................@....rsrc...@....0......................@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):156848
                                                                                                                                                                                                      Entropy (8bit):6.538614114866669
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:2c7Qonv+JBCrms558lMUVnUWxYAJ/Rtrpt2sytOSigKPiSj2eMsRw8e6ciPyyp5B:2G8Crms/8FnPBT7gxShAmwA5cgTx+
                                                                                                                                                                                                      MD5:46D0C5A9F1DFAFB0B842BCB2A944B1C5
                                                                                                                                                                                                      SHA1:233B8E2769625DD09A576035189D4CA3327E02A6
                                                                                                                                                                                                      SHA-256:BF84D8270CC9C4100D8DD52CFF5DEDD30CEDFF723BE38929FA32400BE5D97D8D
                                                                                                                                                                                                      SHA-512:E5026A954F575D4FB24109CAC306AC1D848EA62B16475CDC450D3CEFB4B93E1BC45559E99059F927FC2ADBCE7F95EA11BE2A45A7CCA2894C5AA6310F7355D855
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`.&...u...u...u.yVu...u.y@u,..u.yGu...u..u...u..u...u...up..u.yIu...u.yQu...u.SWu...u.yRu...uRich...u................PE..L.....RQ...........!................................................................x+....@.............................I............`...............J.......p..4...................................p...@...............,............................text............................... ..`.rdata..YF.......H..................@..@.data...H?... ......................@....rsrc........`......................@..@.reloc...&...p...(..."..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1124528
                                                                                                                                                                                                      Entropy (8bit):6.484809189310972
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:Dp6e4S9JuvOCZLmvTO33iFnzQkOMnNf1bt:8S2OOGOMNf1bt
                                                                                                                                                                                                      MD5:5619853A5AC4F54323F54A949160EA52
                                                                                                                                                                                                      SHA1:60D787F954C12A23AB17DDED9F91C6C4B0B22173
                                                                                                                                                                                                      SHA-256:937EC6B0A8D5EFCA5E35F09A11BB6BDDA44FB4EFB9E0CBB9899BF67287820F3A
                                                                                                                                                                                                      SHA-512:1607C6A9614F5D5809BBDBA801E9BD2111977AEAE2114B35FA3110E662ED158AA107D6B2732579F7F34D26424D9C52B3800F0A045787F84363B13C8787B6A876
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j...j...j...8?..j..e%-..j.......j....8.ej....?..j......j.......j...j..Ok....1..j....)..j...8/..j....*..j..Rich.j..........................PE..L...$PUQ...........!.....l...........................................................Y....@.............................t...4........p............................................................. e..@............................................text....j.......l.................. ..`.rdata...+.......,...p..............@..@.data...\........v..................@....rsrc........p......................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\GameCenter.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):324
                                                                                                                                                                                                      Entropy (8bit):5.136652937602475
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:JiMVBd/jXMIWEoAvSsy9LHhIZL/4MpJWrbZiwibUQ5apAYxyy:MMHdb5S3syzM8MpJMidbd5auYxyy
                                                                                                                                                                                                      MD5:FC963EBF1CA23700F99AF46B7893938E
                                                                                                                                                                                                      SHA1:BE3C152C6785F9C9C3605E6BEDAC4EA9D54C4EC1
                                                                                                                                                                                                      SHA-256:2938F3FBB7BF5A078C8629FD4F3D6019F05BCB4FF774CC5E58FD4DE1E5D4EBB0
                                                                                                                                                                                                      SHA-512:C5BE98ACA5FCCBF7DF98FE32EF29675F62471091A4334762AF89CF75BABF4E05D159CACDB445421868B2645F202DD69113689E338FA4C8CDC9818F437F656425
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<gamecenter>...<tab select="mgfindgame" recentgames="100">....<item show="1" action="mgmygame" name="...." from="" url=""/>....<item show="1" action="mgfindgame" name="..." from="" url="http://static.apc.360.cn/cms/recommend_game_new.html"/>...</tab>..</gamecenter>..

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\MiniAppdata.xdb

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):170344
                                                                                                                                                                                                      Entropy (8bit):6.515376474233682
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:X8cE5RULjRoG6LVI4P7+lLdoL6qY0foiStJv5LULIebzLo:Xb0RUfaGiI4P7+lLKmswRPtlG/o
                                                                                                                                                                                                      MD5:301A4BCA1A602AAD88C5E21AE2A8322A
                                                                                                                                                                                                      SHA1:73AEAF28C654C8AE61BABD5681160783520F5963
                                                                                                                                                                                                      SHA-256:977B181508CDE3EFFDE19A22B03127626AF6D96B6ED0B29B7AFB514B1646672E
                                                                                                                                                                                                      SHA-512:0A00B9274485FC4CA8EBA9BA90161AEC950034804076C79E4DE7DF76E971FFF179349E4BF6F72EF4F53D357E2D5D19584B7322C9C8D2DD1DE55BF2F1FBE22209
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eqz.!..L!..L!..L._.L ..L(h.L6..L(h.L...L(h.L...L..oL6..L!..L...L(h.L0..L?B.L ..L(h.L ..LRich!..L........PE..L...R;.Q............................=.............@.................................u`....@.................................LE..........................h...........................................H1..@...............<............................text............................... ..`.rdata...R.......T..................@..@.data....3...`.......D..............@....rsrc................Z..............@..@.reloc...$.......&...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):452272
                                                                                                                                                                                                      Entropy (8bit):6.546876372610879
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:CIx7/JbPCSozzrRM96+V5/sXNsCyBq7FnBvSfSEBoeUICKZMeXGMIrqj5qrf:CIx7/8rnC96s/U97VBvS6EBgInmeXGMf
                                                                                                                                                                                                      MD5:88DA47DCE2422F5CA1EA8CCAF94B0CD4
                                                                                                                                                                                                      SHA1:EC6E45CBB75E468F421AE51378705A1177FB232D
                                                                                                                                                                                                      SHA-256:C0443A671EE72A09FC18942D77A34EBA73A8FE7619144756C9AB019244F24FFE
                                                                                                                                                                                                      SHA-512:631AD4A19B70D5F02E53D63134DE901C0565EBBC47DA3B9B9492A6C1A0548B7311411CBFD668CB5929C7D33D53A1893AA5D1EAE1DEFA0AEA1ECF51177DB1E489
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}t..............d.......d..}....d........w.......a..............d......d.......N.......d......Rich............................PE..L...GYRQ...........!.........................0............................... .......v....@.........................@G..\....7...................................G..@3..................................@............0...............................text...~........................... ..`.rdata.......0......................@..@.data....@...P...$...4..............@....rsrc................X..............@..@.reloc..pm.......n...^..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):339632
                                                                                                                                                                                                      Entropy (8bit):6.596958488639138
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:bSMhbBN0RPgKmQs1wOWTxApJyL1l6niUG+VbNkrk908OI8a+gKeSjt5rPxrCmEaj:bSMhNWRPglwVTxAQ1l6niUG+Vb6rk90P
                                                                                                                                                                                                      MD5:7BC5C0F13A513D3C14432C20DCBFBC6F
                                                                                                                                                                                                      SHA1:086A8E486DC1816C07C2F59015BC7F61408C19BE
                                                                                                                                                                                                      SHA-256:18E443B2582C0B04C92A3A9856F339AC8105AC5F31ACBFAADCA18E9FB74C08E0
                                                                                                                                                                                                      SHA-512:F60CD9D94BD94B740379C0C9736E98048449793894633C13CE39EC4981476ABE9AE239663941844141B2171C30EED0CB350893A82C7B87ABC85C7F7098E3119E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.O.).O.).O.)...N.).F...X.).F.....).h.G.N.).F...y.).h.D.N.).h.R.^.).O.(..).F...{.).F...N.).Q...N.).F...N.).RichO.).........................PE..L.../wQQ...........!.........*......t........................................p.......0....@.........................p...[...l................................ ...+...................................r..@...............<............................text............................... ..`.rdata..............................@..@.data....;..........................@....rsrc...............................@..@.reloc..vA... ...B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\img\body1.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1100x700, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):37228
                                                                                                                                                                                                      Entropy (8bit):7.864517591610191
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:98CQQwNEIXSjdWY0bEhElF8KGi0PezfF9+E66EIb95q9OdSc5wbS:9Ju9Cj4lyI0Pst95XlZ5oxegS
                                                                                                                                                                                                      MD5:14C615D8A20186FFAA9C0C037695A69F
                                                                                                                                                                                                      SHA1:725C85D3C545B61FB7B3CA3D8D4463276D626B63
                                                                                                                                                                                                      SHA-256:CC6519755C02EB71F584D4D2EB9E3E141650DE70C454080D273DA200128CB063
                                                                                                                                                                                                      SHA-512:0FE07F2BE6C86F0309E0511AA102407962FE30063C437D500E7C7CCD4690707025AA9DE3E7D742A8228CD024FD885F64D979F04B7A63DCD9B342AD9A7A49395D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:381B4914B524E211A85B861A494E7F91" xmpMM:DocumentID="xmp.did:BE74084E31F211E2B2ABD4AE22098D51" xmpMM:InstanceID="xmp.iid:BE74084D31F211E2B2ABD4AE22098D51" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D01D3C733B39E211824A9B4353B6A557" stRef:documentID="uuid:381B4914B524E211A85B861A494E7F91"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\img\button.gif

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:GIF image data, version 89a, 126 x 148
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7268
                                                                                                                                                                                                      Entropy (8bit):7.875018624996556
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:lenWc3xb/Xzke27c5B9LKpZRkeWmSZbZ1lxMdO1bGnlnSR1EnAYmG1pWar9b2/+M:lA3hXz950ZRFWmS1HlJ1bGntcEnzvVtM
                                                                                                                                                                                                      MD5:510031EE61056900405C88FA1A2C8D00
                                                                                                                                                                                                      SHA1:41EC7F17186C6B4930AC7628A042D61B1B3A9093
                                                                                                                                                                                                      SHA-256:27C2CDB895B15A081D68E2AB39D1CB93A537BC7E5F88561C23923F533D63BA82
                                                                                                                                                                                                      SHA-512:2CEE5CB9D4589AA3F3803187E63EFF8EE21A4C7A82E57CD5C972CD0AE5DB84359425173BC9A81FD8CF100D0DC6E2E1673EC4FBE3BC3CA12CBDF4F4FB82CCF9FE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:GIF89a~......c...................t.............z.........................................n.....................k........................a........}..........................................................W........................................................h......................................._..........x...............................................................m..n.....L...........i..........X.................l........M....l........K...........V..........................................................................U.....................................................................................................................................................................................B.................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\img\loading.gif

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 11
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1144
                                                                                                                                                                                                      Entropy (8bit):6.7209258789405375
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:J/al1hpunQWwjx82lY2T3gVwxepyJ3Vy8MPmGY88a:GitNn2c6MoJ3IRPmL88a
                                                                                                                                                                                                      MD5:8A86A85455E73B59849061023F0EDB9B
                                                                                                                                                                                                      SHA1:DB960BF642FDA6F8DC2384102B122DE6E48CA915
                                                                                                                                                                                                      SHA-256:748ED7E0D0852816314FFC631D8DEED8739CB2687E2ECA2CDCC414530A2CA6E2
                                                                                                                                                                                                      SHA-512:113531E84D014EFE79D200981032CD148143FCDC1D9F2997EAC2EAA6C36ABB02FC87A7CBB65D4C38F0AEC45461FC7240E72D5FD8A4B99A437C258CAF1884468A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:GIF89a.......j..o..y..l..q..{..s..u..m..w..|.................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:DE32AF8831F211E2B2ABD4AE22098D51" xmpMM:DocumentID="xmp.did:DE32AF8931F211E2B2ABD4AE22098D51"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE32AF8631F211E2B2ABD4AE22098D51" stRef:documentID="xmp.did:DE32AF8731F211E2B2ABD4AE22098D51"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqp

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\installflash1.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2595
                                                                                                                                                                                                      Entropy (8bit):5.764704709834132
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:t/lCq1FhTpK3I63vx7mrZI/IgYw/LIxI63vFj5idgBAI/Ic5KIW/I/iho+yCl+mk:1lV0I0qI/I2IxI09j5iI/Ic5KIW/I/ec
                                                                                                                                                                                                      MD5:E9C0B699AF4A6D01A4F31F44537EE7C0
                                                                                                                                                                                                      SHA1:FADA462FC70904FC8CAF2943DA5B216E74FF4FF5
                                                                                                                                                                                                      SHA-256:B1710AF6E730D11A027A373F07BBA2E2C42CD70E4380A1E383E8CE5EFD230AFB
                                                                                                                                                                                                      SHA-512:156E00C7C72D221AA871184FD8DE42E5137C73183EE057237F80B6AB9B0976AE0EF954D2507CDBDFA71961FAFCF46CA4B3E45A863C46FD57B5E06268E8A9A818
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gbk" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style1.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..$(document).ready(function () {...$("#flashBtn").bind("click",function(){....installFlash();...});....});..function installFlash(){...window.external.wappFlashinstall(0);...$("#flashBtn").unbind("click").bind("click",function(){....cancelInstall();...}).addClass("btn-cancel");...$("#flashInfo").html("<h1>...........FlashPlayer..........</h1>");..}..function cancelInstall(){...window.external.wappFlashinstall(1);...$("#flashBtn").unbind("click").bind("click",function(){....installFlash();...}).removeClass("btn-cancel").addClass("btn-install");...var strHtml = '<h1>.......FlashPlayer......</h1><p class="f-w-n">.............FlashPlayer.................<p>';...$("#flashInfo").html(strHtml);..}..function reInstallFlash(){...window.external.w

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\style1.css

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2187
                                                                                                                                                                                                      Entropy (8bit):5.255911002184282
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZYGCveGXqPF+9jJ1exEU+vZYN96+g8HVACmFnRlxqNDUGXR6awzg:WJ1h+rGRV++MZWlrA9lxq5xBhwzefr8C
                                                                                                                                                                                                      MD5:16FE8C6BD94A0A21217C0D960EF6F008
                                                                                                                                                                                                      SHA1:B799CC35FDB97CDDBD854E8725D4AB1FC4FF4949
                                                                                                                                                                                                      SHA-256:86C676627967C015B858ED8999F337BFA9547CF2A19AC5F1C3582D535C2A0065
                                                                                                                                                                                                      SHA-512:D60311A8B541CCC5B010119C67E3B65D52EC25857CA9CD713355FC7B7F8D8FE4A8D3D8245FE93D7AE2D68787EFD4C33F9FB166BA236815FBFFC6FE17DCF230FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body1.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...blue{color:#1A8DCE;}...t-a-l{text-align:left;}...t-a-c{text-a

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\bg.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe ImageReady], baseline, precision 8, 682x370, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):34299
                                                                                                                                                                                                      Entropy (8bit):7.886401642174046
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:49GOMIVwO5aeCKHpstGctFhM0IkE3ountxkOu3miS+PE2FA0ETeBm:4kIVNMoHpsgc7esS1noOuWi9E2K0Ef
                                                                                                                                                                                                      MD5:B550092E07391F8185F571A9FA468123
                                                                                                                                                                                                      SHA1:E46E480DBD44D633D9F3208D2082EF5996102B98
                                                                                                                                                                                                      SHA-256:BC079E3B3307D409A37B511DB9DDA0BC7C37847A4D1D370B33B7926068D2EE19
                                                                                                                                                                                                      SHA-512:375640C3656B7FCD1225DD5D15415642D1541B136A9190B83B32D8542B942BB0083AFDEB8A11AFD4DF81FEE09821990976866B17B2658DFCDE3B121D2C027536
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`.....XExif..MM.*.......1.........>Q...........Q...........Q...............Adobe ImageReady.....C....................................................................C.......................................................................r...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....p..-....R..P...as.......)..iw....)3.z...Aa@.T.J.b......Q.H.....R...{.......ri. w....o.._.c....@..U....2*;K...J.......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorimg\btn.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PNG image data, 309 x 34, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2404
                                                                                                                                                                                                      Entropy (8bit):7.496022879243684
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:NwqQNn2xpHKJ3KIeUSXdITUNneImrSui7DemFNeGPr5ls8vwIOd4yb3/n:7Y2XHBIeRdIYteIm2ukN15ls8vwI44+v
                                                                                                                                                                                                      MD5:8FA7BA48B848A5562DF10C0784D33F88
                                                                                                                                                                                                      SHA1:DFB3AF8DF29F93ECE124D080D91CDA8469D0E6DC
                                                                                                                                                                                                      SHA-256:A52204F37C386320302A7A8955335169FBC882427447731CFF7E0B0BFD7192C0
                                                                                                                                                                                                      SHA-512:8AB317BF932B6570C75961B25476887FE8DE537A3A1387E477854E0872CA8B169CE97DF0FA792CEAEA4430EA89C0DC7AEE20AA4383E96B8AF3CCE38385D6FCCB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...5..."......e......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:38058E3F653B11E29758D2EAFE369C32" xmpMM:DocumentID="xmp.did:38058E40653B11E29758D2EAFE369C32"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:38058E3D653B11E29758D2EAFE369C32" stRef:documentID="xmp.did:38058E3E653B11E29758D2EAFE369C32"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.s......PLTE..jj.Cd.?.....^..X..Y..Y.._..\r.?b.7h.;}.K..[.._..^y.H..Z..Zx.G..Y..Z..^l.>r.Co.@..a|.J.._..[..[..W.._..\..\

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorimg\t001.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PNG image data, 250 x 194, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7738
                                                                                                                                                                                                      Entropy (8bit):7.909989373853702
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:gmOTV6GofBsXX3PT8bThjYhT/wK9cjWN5E1G:gmgVJofKXPT81GTYqAY
                                                                                                                                                                                                      MD5:C55BBE3F95085359B6A23D7D651B0967
                                                                                                                                                                                                      SHA1:70453F6CFB33E92336F5B80D3DF5B9443C0FDF17
                                                                                                                                                                                                      SHA-256:FDF28877D6CEEEE8FA656DF1162D3F7DF4999E07423EA45AAC0B1A57F3E221B1
                                                                                                                                                                                                      SHA-512:33F95B5881A5F9D2F2B37DC527FC467A53AD64A0ADCF922B2AB12E311C5372AE1C1D85EF35BF8A276AE5D32F347835E71ABBD14AC652F28113192901CBCE843B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............W./.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0F7ADCE4653B11E2B353D0DA90A7D9E2" xmpMM:DocumentID="xmp.did:0F7ADCE5653B11E2B353D0DA90A7D9E2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0F7ADCE2653B11E2B353D0DA90A7D9E2" stRef:documentID="xmp.did:0F7ADCE3653B11E2B353D0DA90A7D9E2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>G"O.....PLTE..................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorimg\txt.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PNG image data, 294 x 60, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4366
                                                                                                                                                                                                      Entropy (8bit):7.834486509641458
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:FY2gjTyweSnqLQNS4ewlZsqS3doIQyNQ6lPh/Ge1QQXsK:FYHy0qU5bZzIQyfh/r1QFK
                                                                                                                                                                                                      MD5:540A2A3CB4331443977F78420261F362
                                                                                                                                                                                                      SHA1:47FA9BAC4C575E8F1ADB0B568FC7F90E8FE6468E
                                                                                                                                                                                                      SHA-256:586E93608F5A2F87274DAB6D1864AFEB30592D177C94030DBC05DBD7D871671B
                                                                                                                                                                                                      SHA-512:2AE08DB067A0C939DE67404ABAAC05D7B115D82B81B7F48188C81467BB89C32BD39318CE09AE0ED09C218C20462EE821E31045D2E91BB3A8A274A0BAB17D75BE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...&...<...... .....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:200AF0FD653B11E2947F934EBAB32ABE" xmpMM:DocumentID="xmp.did:200AF0FE653B11E2947F934EBAB32ABE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:200AF0FB653B11E2947F934EBAB32ABE" stRef:documentID="xmp.did:200AF0FC653B11E2947F934EBAB32ABE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.]V....`PLTE...U...............................e..............t..........................................:.c.....IDAT

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorpage.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1541
                                                                                                                                                                                                      Entropy (8bit):5.521914842254377
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:tJJyE98h2ehVqc2cZsaEQF2mdwPFPza+7+NJGf:UE98h2e7D2cZsaEQF21W+7+NJQ
                                                                                                                                                                                                      MD5:9C6137B11D28178BF2E369E05267D808
                                                                                                                                                                                                      SHA1:76E470E1D91262734464D26E9D0EED634B14A89C
                                                                                                                                                                                                      SHA-256:16523A645013AE034A997096F0019E735431F54C7C641601A9CDD7A63109BF40
                                                                                                                                                                                                      SHA-512:6BA2A34C988FF085BB3D088B1F071FC525B0328F122CB04D4AC9A4487A5F7124496984FED9D60BABEE9A1BB1144C674283FB4B216BD9A4DEE2D31B55034593FD
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta name="Keywords" content="404" />..<meta name="Description" content="404" />..<title>404</title>..<style>..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0;}..body,button,input,textarea{font:12px/1.5 Tahoma,Helvetica,Arial,'....',sans-serif;}..fieldset,img{border:0;vertical-align:top;}...w404{ width:555px; margin:147px auto 0;}...w404 dl{ clear:both;}...w404 dt{ float:left; width:250px;}...w404 dd{ float:right; width:294px; padding:37px 0 0 0;}...w404 .btn{ display:inline-block; width:103px; height:34px; text-align:center; line-height:32px; color:#fff; background:url(errorimg/btn.png) no-repeat; text-decoration:none; font-size:14px; font-family:Microsoft YaHei; margin:23px 0 0 5px;}...w404 .btnhov{ background-position:-103px 0;}...w404 .btnclk{ background-position:-206px 0;}..</style>..</head>..<body>..<div clas

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\img\body.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1300x900, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):44512
                                                                                                                                                                                                      Entropy (8bit):7.4966322244558405
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:ZUegN/65ApY1kMvGuRIqOwJw+L4yWn1EOWLHSNkGfhqe/byvgMaCdnxRZQPIxTWX:ZUegN/gAakBsIqOwJDUyI1EOWLRGJDWc
                                                                                                                                                                                                      MD5:2920FB149DDDCE84FE9D62336259CC72
                                                                                                                                                                                                      SHA1:53989CA3ABC1B56AD8F6CFEA3216141FB1DD8171
                                                                                                                                                                                                      SHA-256:5221116B3F0D8B02C93045510B91A66412E0D8FD998156CD10E055E70A2E105D
                                                                                                                                                                                                      SHA-512:03B74CF361017DAEC1DF6EC5A490A9CA586C2259F8EB9401F8F1417546AC5F82373530134EC96D57333AD2E995B516F939941FC89B703DE83792B1E5739246FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......<.....ehttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="DCE0E11121C3596AF96F3EAEDBAF4DAC" xmpMM:DocumentID="xmp.did:92100F1F28D211E2B979A4EFB5CC2C9E" xmpMM:InstanceID="xmp.iid:92100F1E28D211E2B979A4EFB5CC2C9E" xmp:CreatorTool="Adobe Photoshop CS6 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:461E920728D211E2AD1D95A99DEA1E06" stRef:documentID="xmp.did:461E920828D211E2AD1D95A99DEA1E06"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.......................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\img\loading.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PNG image data, 420 x 18, 8-bit colormap, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1909
                                                                                                                                                                                                      Entropy (8bit):7.234982063350527
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:PCCRgnxwhC+1SOLzA5+MTFC+M/BA6AlIxrYzI:KoyS8Og5rTA+BlCrYU
                                                                                                                                                                                                      MD5:9DA3F1D059FECE8DDB1F6EDF43AC2363
                                                                                                                                                                                                      SHA1:DB62DC742686C128F461938287DA27E4C522B1BF
                                                                                                                                                                                                      SHA-256:E923BC0678176F9847AAFF4AC59E9F7C39780469BA29F6BAA481BA99312EF7AC
                                                                                                                                                                                                      SHA-512:AA0DD1E1677D37386FD998676747D445D62DA8DF8A05B01A62FA5FE8D895EB428C473499C043957497AE7CAB63D6524A93B18ABDB900813355DD13D484BFC6F2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.............#vZ.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEp.....t..............l..|..c..L..Z.....R..E..J..z..i..G..r..`....Q...S..Y..V..O..T..d.....M....ou.._..f..a.....G..{..{.....b........L..H..b..R..M..N..W..S..p..Z..l..t.......aZ..a..Q.....X..N..M....#M..s....mk..Y..i.....a..Y.......iZ..k.....r..R..V..s..s..o..Y..s..j.....s..z..S..c....t..X...H.......YS..F..^..I.....S..c..P..T..H..[.....w..R..P..L.....|..K..H..K..M..M..Z....hN.....l..]..R.....Z..R..S..S.....L..../Z..m..r..s..I....qL..N..a..Y....6R..r..Z....+{.....W..j....{O..l..^..`..|..g..M..j....JK.....W..v..t..d..O..J.......E...)i.h.._..L..p..J.....t..$j.`..b..f..L..^..e.v..6-p.[..a..:w.F.4a..,r.'n...26}.>.m$k......g~..]..6|.@.o..QR.3j..J....Zd..U.1%l.e..k....*2u.F..x..-s.M..G.%.....(...3.lc..'o......=..T..x..3t...t_.....|:F.....tRNS..................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\installflash.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\intalltempapp.html

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):519
                                                                                                                                                                                                      Entropy (8bit):5.160278137718593
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:hPgGxC7/mjWsVnqJmxTTqK5eQE8OYMCcfxqc2OAqUKCGb:hPrC1sV8IfvEYMCo9z
                                                                                                                                                                                                      MD5:B00593D03F76B157C02A72A9F132405A
                                                                                                                                                                                                      SHA1:FCE91F62543C4104BB906F3A83F6DEB7DEC0F5BB
                                                                                                                                                                                                      SHA-256:825D1318B7463FD5F670958C5E7BEC7D609340661EAD84ABB4F2E68FF987498B
                                                                                                                                                                                                      SHA-512:A33793891F05D7610FAD9D5B6F1EBCB4799871BE6F00C964E1390F36421085DC04DD1AE2C7BBB219FABBAB2FA94EAB2E923B491C81871A06EEA33EB639CBF2C7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..function changeProgress(value){...$(".in").css("width",value+"%");...$(".percent").html(value+"%");..}..</script>..</head>....<body>....<div class="box">...<div class="loading"><div class="in" style="width:0%;"></div></div>...<p class="percent">0%</p>..</div>....</body>..</html>

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\style.css

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1657
                                                                                                                                                                                                      Entropy (8bit):5.247663084618733
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZICveGXqPF+9jJ1exEU+vZYNo+g8HVACmFnRlxnMXUbF:WJ1h+/RV++MZMrA9lxnMXaF
                                                                                                                                                                                                      MD5:7E0FB59D3AF2D442F44A939362311DD0
                                                                                                                                                                                                      SHA1:3F1FD2C2B9DDC773B6972F767BD321F353C6066F
                                                                                                                                                                                                      SHA-256:DF9459349CCB55416078BA535A17AE8587BF321049F4D0A5AF460879B62B4699
                                                                                                                                                                                                      SHA-512:03D0D5D69C38A7E1F75D39A31E9C597B862F9D1BEDFA14C4CB8FD37EFE5800FF01F97A917A8ABDE8C33E98A87436101D183250D101E5BB85B1686A1F3B3B7935
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...t-a-l{text-align:left;}...t-a-c{text-align:center;}...t-a-r{te

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):203608
                                                                                                                                                                                                      Entropy (8bit):6.832543174324689
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:CxIYp86FpmNh/ZBypa4ZunTBfHFy6Ag0Fug795fz8:e86As2nTBvFy6AOIvo
                                                                                                                                                                                                      MD5:D3A9CA700C1C65D6DF7E010B0CB0E3F4
                                                                                                                                                                                                      SHA1:8E35CFC937B783808DA98376B5ED6163BD77148A
                                                                                                                                                                                                      SHA-256:CC4D278AB85A0CEF68EF29FDBF723830C4F2BCC78B5B315F1530674059BCF0CE
                                                                                                                                                                                                      SHA-512:8102BFEC316B89BF100350607491942332E881AA80981AEAEF8F607CAD5A4661B8E07BD9FE74506D8D775A56FACE181CF342074668338D42A3250A041AED4269
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...............u{...................uj.....um.0....u|......_z......u......Rich............PE..L....HdN...........!.................6....... ...............................P......x0..............................P...K.......<.... ..................X....0..........................................@............ ..,............................text............................... ..`.rdata....... ......................@..@.data....3..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):343680
                                                                                                                                                                                                      Entropy (8bit):6.438296507662578
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:Od5qu1VG/cPM45zTHtcpBBzCXkLDLdfewus5qdr2ZdS1ltQp6:Odgu1VG/cPM4uBzCXkPLkwuwiu6
                                                                                                                                                                                                      MD5:A1ECB29EC8237F21ABD334830573EC34
                                                                                                                                                                                                      SHA1:DAD2D8F5976A018F3A5FE95C7DA5D8744971D5F8
                                                                                                                                                                                                      SHA-256:AB07B5413EB43D56151EA1B072945A3FC0C075BF108AE9977EDB46B7D102E9E9
                                                                                                                                                                                                      SHA-512:EABF128304CAB9540556984C43EFCA678897CA9DA07D5949C698156A6C38E8A23D037E98B7138D1930C33403185BDAACC842C79EFBA20FBEBB1379C437A2DEEB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tF..'F..'F..'O.3'W..'O.%'+..'aV.'A..'aV.'I..'F..'...'O."'|..'X.2'G..'O.7'G..'RichF..'................PE..L....NuP.....................t....................@..........................`.......>....@................................. m...........\...........(.......0...+...................................<..@...............|............................text...Q........................... ..`.rdata..J...........................@..@.data....E.......(...t..............@....rsrc....\.......^..................@..@.reloc..B,...0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\360GameBox.ufd

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):572982
                                                                                                                                                                                                      Entropy (8bit):7.993988525472661
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:12288:afcKHBaJAwO7jNpFpybbBzSC2t9rc+dq1FAfpSX6WP1Vu:oFHUSzFiBMfc+w7AfpSXXu
                                                                                                                                                                                                      MD5:0B62D44B3760E9C3A723CBC9CA8D28DC
                                                                                                                                                                                                      SHA1:461437901D10AA37F0B1DEC2D8B2EF9B56BAE1AF
                                                                                                                                                                                                      SHA-256:C4C3F29CC6830A37C7E5FFCFD44E72F98EC713D46CF355F0F556FFBE25B62C05
                                                                                                                                                                                                      SHA-512:C43FFCA76663AB255A8922511BED7CA77870619D28A292A76A2CC484067A18F7939C1B0381BD4A4726B1F7ABD0B16EEAF8BB7CF06BAFDA433D7307EDDB63B0F8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:P......1.62.tips_1.png.........PNG........IHDR...~...K.......3.....tEXtSoftware.Adobe ImageReadyq.e<...zIDATx..]KO.A..y..>X..(.. .=)\<y..<I.Q......OF...7...41._.11F@@X`w....{.....b....A..Y........X.1......0.-#...5.A.V..P...q.3<H.. ........O....e.b@.B.m.*......[VX#..F....q..R.My......~....40....Lq....J....... \...@.>.{.W..i3....j#......R..G.tg....5.!pke..S....a..U*...]go7.....sO.i...Y.^.........#...Y...5..3. 7.......dl.}}).~!2?&>.IY..W.....G...&.....{.V.j.vL.[68. 8.h.y;..W~....u/..v...../8.....%.).i...X.`aa...zh?~...........l.R....8R.....gL.K.K.gaqy....+..8...I.%....r.N]}..\wh=.`}....#.........v*...s...C.p.FxM.`...c.U...wh.J..B..B..}'.+C<^....h5.6.G...>XY.......I..+.l.(A<J..@...{W....y.,...i.%.%^8.P..z.....&.b.,.F."....(k<...O8..O......O..@}.......X...k..%...|'.M.z.{....}C>A.Xp..S..[.I.I.[.R.k...I.h#Gg.O.IC..:.Q;oD.O.z...........(4.)=.s4.1.z..9z...q....>b...(H...O..y.~.R.(i.\.MW.....S3.%..:h....E...x3.gmv.{.I....>.......O]..]=E..._.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\GuideBalloon\LoginGuide.png

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PNG image data, 183 x 73, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5956
                                                                                                                                                                                                      Entropy (8bit):7.9594836492593295
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:QbK+ZJ2vCF4s9VTictWZY5Am6oxbBJz/AAi2lrVLR4IPatv33ToS5Kdv6rfIp1:bQImxVmzZY5AfoxbrzYWpVLRch800vWe
                                                                                                                                                                                                      MD5:5EC40557CCB2E9A39879EA799018EB26
                                                                                                                                                                                                      SHA1:82FC6D094606514841DFB5AB864B846C5A5A46F5
                                                                                                                                                                                                      SHA-256:EB25D78399475BA7BA0BAC83C90221759BEFBA256A55A5245BBED1C74E3140E3
                                                                                                                                                                                                      SHA-512:E5C6452B7A8E43DB52776BE09C8DA4AD1E6613FC3883F18FCB1B57643714C8D2BED45C553FFD3BD6EB95A6C0795294024355CB2C17E8D55BD6F012D7CE7B4D2A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR.......I.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..].X...l.............E..E.V..[.......W.......h.....j..j..W[..Vq.\X..E! $!{23w.I&$1......0.Lf9s..{..~.9g..$...Z[..2X/....p.%.|d+.....6.6.t..Q.(o.......C6|...\..YkC`sK~..(8l}h.|.......`?..,s....].k._...K..3.|..X.:R...U+V....u..O.g..Z..{....Y.../......<.~.7.2.R_|.O....h.%....g...V.6..OGH..B.I{e=$..."........b..9<..S....I.Q.i..p..Yk5....HY..I..}...\.4{.(..]?G...>s.zV...VS.$Xp.v....q.H%A.I....d.9.i..b>..*"U.....5..7uO.r...;..L1....ZK.].u.h.4.si.....P.....k....?.+......s.....9..@....n. t..o...~)..Xk..F....C..q...t5.bV.#.#fC.._...'..{O....4.........YAq...A..%o.Zl AHm...4....fr_H.4k.....e._.<...N.....q&.c.P^+.C....X..5....\?8<.../.)?9......17(n.W.r......._.1.i;....Z......pl.4.Q.....u.9cs..N.Xc.#@.q$...uPt.]...g.....g.]..YX.... k!...id;...Yx.v.....1a.2...^Iw...o... .......,s...T\."!..).gK..I.F..1~. t.....g.9.X~>W......`b....3G.[...}%...']...[..Z.Q...jjx....M

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\ThemeList.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1083
                                                                                                                                                                                                      Entropy (8bit):5.602790065569643
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:JdBHaPqjqobWDwjYvLPRioMjfGLkyvH8z:3Pq+4v9eZ1
                                                                                                                                                                                                      MD5:1A43711E10689A071666EE439ABDC859
                                                                                                                                                                                                      SHA1:D173A82DCA6DC00811350BD3F63C8B8323B0F759
                                                                                                                                                                                                      SHA-256:76880D582882C914367F3CD34683C57DC6EA1051B7A89DC6CE9F612FEEA7989B
                                                                                                                                                                                                      SHA-512:9FBA6A2D63B4E02E70DA3F7DCE50979CD547D89E49362A568549CADBC775849FF37DB30163F00B0CD85E023EE80187DAC93F5527BD34B11D0FC180EEB89F2F52
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<ThemeInfo>.. <ThemeList> 0.......-->.. <Theme id="5" name="...." package="Theme5"/>.. <Theme id="0" name="...." package="DefaultSkin"/>.. <Theme id="1" name="...." package="Theme1" down="http://dl.apc.360.cn/skins/Theme1.uiz"/>.. <Theme id="2" name="...." package="Theme2" down="http://dl.apc.360.cn/skins/Theme2.uiz"/>.. <Theme id="3" name="...." package="Theme3" down="http://dl.apc.360.cn/skins/Theme3.uiz"/>.. <Theme id="4" name="...." package="Theme4" down="http://dl.apc.360.cn/skins/Theme4.uiz"/>.. <Theme id="6" name="...." package="Theme6" down="http://dl.apc.360.cn/skins/Theme6.uiz"/>.. <Theme id="7" name="...." package="Theme7" down="http://dl.apc.360.cn/skins/Theme7.uiz"/>.. </ThemeList> .. <CustomThemeBkList>.. <BkPic path="PublicRes\Dialog_background.png"/>.. <BkPic path="PublicRes\MF_Dialog_background.png"/>.. <BkPic

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\snap.wav

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):9319
                                                                                                                                                                                                      Entropy (8bit):5.709760477776144
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:VSANTRi/piY1ampozS+ap7TeVXqbjnhrjaODb3FFDu8FOQNvQKqRlgHeSok7SZ:VpNTen1aoIYT9vnhfasb3HKGOQNONSoZ
                                                                                                                                                                                                      MD5:509878B3E709B28DC2149542E25E4987
                                                                                                                                                                                                      SHA1:A67A84B59A95245BF37600513C139927D8723457
                                                                                                                                                                                                      SHA-256:90FF377047108C69EA3CEDEE01DE3613FBF4A61163583C03FCC15BAE6C2B1667
                                                                                                                                                                                                      SHA-512:B4C53CD585B5C508ADD92DD74EDE8049768D66DAB209D795D01B850CD27882CDEE8F41FADCA3C9D29DD86A9EEF62B3154835B25EF5898EDFF47854E4EAE96FFA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:RIFF_$..WAVEfmt ........"V.."V......data;$.............................................................................~z{..qpy..g....~od....v~.vx..mx..yk..|]v..rg}..x{..`..iP..nluqE~..bh9s..`C7d..B-..Oa.....p=q...NY.p...j:a...AJY..YPe...h;4s....rcI..hdffv...u.....}Nat....sy..sdir....|..k_g.......z{xYj.......oYj..~r...WLz..u...u;y{o..]8].....NGmG;......^D[e@O....g73Z...}{x.PHp...|p...V^s..{vy.wr...og|...q_g}..r...]k..rmmou{......oas..|...|}xox......i_o......u..y..vu..uh..ycp..._rw.....]d........w....sv.{{...|....{in}....~xnp{......x~.{osx~...{uy{..~{~....w~..ot|....ysfz~.....~u..xss....g{..z...{..u{..u...v{..|..~}...wx......~z{|....|...x}..}|...~....zz......~...}...~}~........|{....|z.~..~~...................................~.~........|~.....|...}z}..|}}....~z}....v...|z...~||...~{{.......~}..........{..........~~..~|...........}}................~~........~{.......}}..||............|z........}~..........~...|....~{.....~...~....~.....}|.......~}...~}...{{{|~~~...}...}||}..~.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):825008
                                                                                                                                                                                                      Entropy (8bit):6.5491447938841825
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:eY4r48i/je7GlpPMDV3be+wkhrx5dR/bPkuaYLdp2ku5ZGSlpTs6ILauDp:qr48i/j8YPMRrwk/RasdQkATfTB4p
                                                                                                                                                                                                      MD5:AD7141EBC34468ECE687A5399FB1B05E
                                                                                                                                                                                                      SHA1:159079879E57D6C1E4E599D7EBFA58EAC289D0F4
                                                                                                                                                                                                      SHA-256:451ED78D762B64984402DC939228C00AE608FC9D1B1BC3BF6EDB767F27462FAF
                                                                                                                                                                                                      SHA-512:99921BA6E7EC23C47B3AA9A275ABAF42B80EAF25773EDF13CD50DB60A00CEFB393DC376C238C31D1D66661771A2FB6844DFC576C2C325D29749E431EC2516A17
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......67..rVb^rVb^rVb^l..^wVb^...^sVb^{..^hVb^{..^.Vb^{..^.Vb^U..^tVb^U..^oVb^rVc^VWb^{..^GVb^{..^sVb^l..^sVb^{..^sVb^RichrVb^................PE..L...u4.Q...........!.....................................................................@......................... ...F............ ...............|.......0..dq..0...................................@...............,............................text...Z........................... ..`.rdata..f...........................@..@.data...<r.......>..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1257928
                                                                                                                                                                                                      Entropy (8bit):6.637557852291585
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:kCHfpvtT6uNohYg07OmzFCN26/5JIqfjNm+uoSNt7LJi4uUDzBeDpnE2IVs5Puwj:kCC5K7OmzF57Puo0aYuTBcPP
                                                                                                                                                                                                      MD5:B04F80F63C9A0ABF6A287ADC4AC661E4
                                                                                                                                                                                                      SHA1:54E9CB2396FD8708CF40B44F8D51DECEA38BC52E
                                                                                                                                                                                                      SHA-256:BDBD8D832B8C6E8AFCFBA93FDC656629A34D7721FD2339D346A26FF2495268C0
                                                                                                                                                                                                      SHA-512:7B9DDAB383E7482D05FB20A6106C2044779AFC2CBA557B953C812A8872B1272593BDC656C3BD2C7F70126BB4A852958BE84EEEAE69F3C9C12DA46C2140A9F4A6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:d}.:d}.:d}.B.}.:d}.B.}.:d}...}.:d}...}.:d}.:e}=:d}..v}.:d}.:d}.:d}.B.}A:d}.B.}.:d}.B.}.:d}.h.}.:d}.B.}.:d}Rich.:d}........PE..L...'..P...........!.....h..........................................................`.....@.........................`...[............0.......................@...}...................................................................................text....f.......h.................. ..`.rdata...W.......X...l..............@..@.data....(..........................@....data1...............d..............@....rsrc........0......................@..@.reloc..|....@......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):399344
                                                                                                                                                                                                      Entropy (8bit):6.525659947793564
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:Q60nOaN+UpBOp+j1stF+sb6YkgXti5Y2ch+:QJ06fIQ5Y2S+
                                                                                                                                                                                                      MD5:77106684F45C7C504B21AD948956734E
                                                                                                                                                                                                      SHA1:5043039A8BC35EE71D8F17B921F35D6DEBF01831
                                                                                                                                                                                                      SHA-256:F3803AB55BBFFFECA21BAB8BED43004A0DD019B1A97196602825E1D1D61C9554
                                                                                                                                                                                                      SHA-512:4DC02E47B6071395D7CDA332CE74109F92682C7A00346C3DC0160D9747881D78A93F38B20A7C4CEB1B5E25B1E6CC86D3AAC98780AE40F3378C4DE007CA951C9D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qW. 56.s56.s56.s...s46.s.y.s46.s<N.s)6.s<N.s.6.s...s"6.s56.s.6.s<N.sU6.s<N.s46.s+d.s46.s<N.s46.sRich56.s................PE..L....q.P...........!.........>.......+...............................................l................................../............@.......................P..|....................................U..@...............0............................text.............................. ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@.reloc..@D...P...F..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\PDown.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):210408
                                                                                                                                                                                                      Entropy (8bit):6.507157820903005
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:TJnuJFUvm00JlB8uLp/Me7AQo7ZWQueVMAI64kliFa/nyG5e0P9:9nuJFUvSJP/Bid9/VMg4klfiI9
                                                                                                                                                                                                      MD5:23944F2C8C2614814CD9EEEAD7C15622
                                                                                                                                                                                                      SHA1:FE5BFBED6900D976AC56EAC386423D82A35BDE7E
                                                                                                                                                                                                      SHA-256:68CB47636533713F460FA932975189BEFB0DDCA0750E8F75418B6C616F9BA3BA
                                                                                                                                                                                                      SHA-512:C16AC9EB39375950E554CB6C2814ECD385D39F2729DC2B26618647705D99DE7A2626759C3DEEB8C8A12E7658ECE6A5569FB1EF5D01B8F1CB8CFFAD7EEFE92555
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................o.~......}......k.A....K.........h.....l......z......|......y....Rich...........PE..L....q.P...........!.....L...........N.......`...............................`.......3............................................... .......................0..`....c..............................`...@............`...............................text....J.......L.................. ..`.rdata...y...`...z...P..............@..@.data...@<..........................@....rsrc........ ......................@..@.reloc..^*...0...,..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Uninstall.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):249267
                                                                                                                                                                                                      Entropy (8bit):7.821561013172663
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:kpDndxg7ab4Ho0b6exvxAWjdoZfVyuKDAJUFgi:2n3g7ab4f6exvxXjdagPDAJUF3
                                                                                                                                                                                                      MD5:D164B3E10043192B85DE20E1CFE73DF1
                                                                                                                                                                                                      SHA1:9F53A5145B67FEEF00C514D561DAA478BEF9DAE2
                                                                                                                                                                                                      SHA-256:88E9FDD567AEB8D339C47BEB4B9B860E36CB4FD65837E65461B0479D15B51AA3
                                                                                                                                                                                                      SHA-512:116357B40B90CB9B84F5E3D2DAE7C5DED16E73A67CF794060808833FB84846BDC5404CF5BB9943D9AF5E6BF4978FE79B64098DE8DBA517648D03D560967EE34E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................0...............................................s...........E..........8s...............................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....E.......F...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\safelive.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):397240
                                                                                                                                                                                                      Entropy (8bit):6.559659900193761
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:gG1eHqeh0S21bC5k+5HsprlHPohiLesYTM7Pol5Cm6Kmvn7/OZcnPxNWj:h1eKeDp5kwMprlwYlYUPol5Cmdmvn4j
                                                                                                                                                                                                      MD5:EF03AA3534F302E6A4DE1FA6BB6C9678
                                                                                                                                                                                                      SHA1:6A67D0BD8BDDFBE0479BBDD4166281FF3DCD0D7A
                                                                                                                                                                                                      SHA-256:E7CCEAF1534BEF4F656E72C8069BC82BBA836774868A39F5691E7D4BF9EF6450
                                                                                                                                                                                                      SHA-512:650D9156F3A185801D1B57845ECEDAEDF1A392E5EB8341E5537AE082FE8D7D3749B30B6878A41EB4BF9204C4DAC535C3614859B1CD65D25CACB95695FA383540
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}..S2<..}....?..}.....}.....}...}...|.......}....).U}....8..}.../>..}....;..}..Rich.}..................PE..L.....kQ...........!.....z...v.......U.......................................P.......................................j.......S..@...............................L5..`...................................@............................................text....z.......z.................. ..`.rdata...............~..............@..@.data...D[...p...6...Z..............@....IShareO............................@....rsrc...............................@..@.reloc..2O.......P..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\updatecfg.ini

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3712
                                                                                                                                                                                                      Entropy (8bit):5.3165952252595785
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:tbMwNvzmy2LQfcqtFKaxLXuaxABSxsxALSDz:dMFy2LQfcqtF797JSDz
                                                                                                                                                                                                      MD5:2A23E02DD99808E7B8759D7BADB3AA64
                                                                                                                                                                                                      SHA1:C4EC5657B0D93381590504033D3DEDC5C1582770
                                                                                                                                                                                                      SHA-256:E4F1F378EA7987F288AEAD33828B33528DBB174A949F00960CF23C1CE9190850
                                                                                                                                                                                                      SHA-512:2A919FF3184D695CF1530085947F2ABCD1623B653F89CCF5566C9A10BC8EB3995DCC055CC21EFF7746948E39B111F6E35F214A4C06802C1A929745A4FB06C148
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[LoginGuide.png]..ver=1.6.0.1020..md5=5ec40557ccb2e9a39879ea799018eb26..path=C:\Users\user\AppData\Local\360GameBox\Bin\skin\GuideBalloon\LoginGuide.png..[360gbsc.ini]..ver=1.5.0.1010..md5=d41d8cd98f00b204e9800998ecf8427e..path=C:\Users\user\AppData\Local\360GameBox\Bin\360gbsc.ini..[GameCenter.xml]..ver=1.5.0.1060..md5=fc963ebf1ca23700f99af46b7893938e..path=C:\Users\user\AppData\Local\360GameBox\Bin\GameCenter.xml..[UiFeature.xml]..ver=1.5.0.1060..md5=5a9ea5d17938b505dab8374d23ef5f01..path=C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature.xml..[ThemeList.xml]..ver=1.5.0.1010..md5=1a43711e10689a071666ee439abdc859..path=C:\Users\user\AppData\Local\360GameBox\Bin\skin\ThemeList.xml..[MiniAppdata.xdb]..ver=1.5.0.1010..md5=848e2c1f7b26a733d26d2f16ce8859b3..path=C:\Users\user\AppData\Local\360GameBox\Bin\MiniAppdata.xdb..[bg.jpg]..ver=1.5.0.1010..md5=b550092e07391f8185f571a9fa468123..path=C:\Users\user\AppData\Local\360GameBox\Bin\apppages\bg.jpg..[body.jpg]..ver=1.5.0.1010

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):111744
                                                                                                                                                                                                      Entropy (8bit):4.018161304500342
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:blUHkoG653Wljk0Vs0OQ684wNmLyIujyHH0PO2kVR1vND3xFJmyyp13ceGhtibGa:mko5l0OQ6J1htibGCn+GFTKneAvFa
                                                                                                                                                                                                      MD5:2DB30F0696AE8A1CA7B22AF378B8513F
                                                                                                                                                                                                      SHA1:719E675EEF50FDBD245C0519DBECDCE213BFC1F5
                                                                                                                                                                                                      SHA-256:2F7571D4045F96FC6D7DC5973B9ED65D2F112319C9534F13B0B7DFBB7284AC5E
                                                                                                                                                                                                      SHA-512:8749715E7242733CB3B5563187CD7A4D892BA231A736FB04D06979E5492EEBD0074F59E15C83E4918C67E51164B76BA4ED70C37596E5FC946120C176C7FDAFB8
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....h... ...............P...............[...x...a..........h...........Y.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................h.u.b.e.r.t.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):111744
                                                                                                                                                                                                      Entropy (8bit):4.018576590750433
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:AlUVkYG653Wljk0Vs0OQ684wNmLyIujyHH0PO2kVR1vND3xFJmyyp13ceGhtibGY:ZkY5l0OQ6J1htibGCn+GFTKneAJFa
                                                                                                                                                                                                      MD5:F3E8A7D7B33258109E2A72B06A0F3EF6
                                                                                                                                                                                                      SHA1:F5F1436DB0715B4D6ECD163D26A8641D87199052
                                                                                                                                                                                                      SHA-256:E30A691BFC35B03123A2B0B15641EF0AE2DC6DAA2F198CB58DFA437A6625F825
                                                                                                                                                                                                      SHA-512:F80477E436FCA364D10115D2CF083B3255D647A533175C7D44060CF634219DFA0ED9408D30C787BBD71D0C9AF8422800DAAC04DBFC02DF6EC8BF797DE6449537
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....h... ...............P...............[...x...a..........h...........Y.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................h.u.b.e.r.t.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):108056
                                                                                                                                                                                                      Entropy (8bit):4.046781396587275
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:nlbFkeGt4O7ejk0NO395HodtINILG2DjE6F4PrppR1vk2zp2emEypK3Tzx7e3hDY:jk14q395Ho4uhDiuGKnLJF9KV7Y4
                                                                                                                                                                                                      MD5:B30AF430D3378CBFC07EE6A780FB745C
                                                                                                                                                                                                      SHA1:AC5FA56BA9786C112CB7EBB4BE85458038730373
                                                                                                                                                                                                      SHA-256:2CB96C1CEAB49E634861745DA0969401AC68A8D78D6D6540393435D9B66282A3
                                                                                                                                                                                                      SHA-512:01F243A158A6B5B6B3F7D9A8A974FA7FC20CE8E69284C67983EB508C07B94B41EDF33F36F9D64EBA272C1D6650E0C0C95DD6A0139D3F36C5E050E98738B21F22
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:....h... ...............P...............[.......a...p...................Y.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................h.u.b.e.r.t.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\Windows[2].json

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):533
                                                                                                                                                                                                      Entropy (8bit):5.149567332262776
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:YWgc2T9i9L8H+5i9LiroKDMH+2yrZMAE8kEUq1HLxyp3c3Z:Yzc2TAN8HTNikKwHt0BUER
                                                                                                                                                                                                      MD5:986B7B0A0922851F26B8AC96AFAE5797
                                                                                                                                                                                                      SHA1:6718DAC8C9FC537124C6633D3F6799C33E26F522
                                                                                                                                                                                                      SHA-256:0CA2EE9A26B3ED845A872380C60573B7C3282C287B115D03C74EED3A629F6FAD
                                                                                                                                                                                                      SHA-512:73D04A25BB376DB148A292DF65C07801C4B2F07B95F038400BFF2A0D7B8DC1144E588B92F40CECAA6793ED0BCD1BDCB79E86B74ACD909F0631BC9263FE34200E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:{"serviceContext":{"serviceActivityId":"658e02e9-41f4-4754-a4a5-88e24583fb4f","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"658e02e9-41f4-4754-a4a5-88e24583fb4f|2023-12-28T23:21:13.4480166Z|fabric_winfeed|WUS3|WinFeed_612"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"webView2Enabled":false,"webView2EnabledV1":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false},"isPartial":false}

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\360desktop.setup.log

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):145187
                                                                                                                                                                                                      Entropy (8bit):5.402502031064798
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:YRmMphojoOKw9Mg8d1dc0EJG3bdD809eyiUmkjNwuIA5g9qcm7lV1yumQTIt4mTF:ZrhKwodhIAhVRc3KrVDUGYzl
                                                                                                                                                                                                      MD5:AE317AB0905394A5F58F162D989F641F
                                                                                                                                                                                                      SHA1:487D2C0D3318E01FF1378864EE4E2BF566D1E73A
                                                                                                                                                                                                      SHA-256:9A656F2C978373C2F52561DC75602C2D4025A030B8B104258D4CD80B4AD60E8A
                                                                                                                                                                                                      SHA-512:70F93A16F3EFC4FE353E92336A3B2A577D4917CF33110AE17336454E5D59546306C7209483BD5E0FB0896F6D85438A75CE926F74070BB1C7FE7B20EE93C6F544
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:2023/12/29 00:19:54:447 Begin setup......2023/12/29 00:19:54:447 Command Line: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe"..2023/12/29 00:19:55:884 waiting for Click Start button ...2023/12/29 00:20:03:509 ...2023/12/29 00:20:03:509 ////////////////////////First Step////////////////////////..2023/12/29 00:20:03:509 Start Prepare initial information.......2023/12/29 00:20:04:041 Start install thread... ...2023/12/29 00:20:04:041 ExitAllProgram Start, Dir = C:\Program Files (x86)\360\360Desktop..2023/12/29 00:20:04:150 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt.dll..2023/12/29 00:20:04:150 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll..2023/12/29 00:20:06:134 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll..2023/12/29 00:20:06:431 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll..2023/12/29 00:20:06:759

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\360verify.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\NSISdl.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):14848
                                                                                                                                                                                                      Entropy (8bit):6.042975836390264
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:/4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12FgszA:/ysdM80dCI5a2LsQ5IlPNRY00AlAbU
                                                                                                                                                                                                      MD5:A5B84D250794433DB5A2D26F34699DD9
                                                                                                                                                                                                      SHA1:BC06ABCCF6A4783973EC11B6766B43B4A265820C
                                                                                                                                                                                                      SHA-256:96F3357A024C549D7CB9E6447B1A56A2A8029B4F12E6E597428E68620761C5E0
                                                                                                                                                                                                      SHA-512:121D67F85A24096799ED913DCCB64EF65D9479F98A6D88C2A0E05F05A65F460D557C5FDFE2C42A0A61B9CBAEDD9B7031978111A2713250A89848AB4F3BB4CE84
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Ht..H...H...H...Ht.H...H...H...H...H...HRich...H........................PE..L.....pG...........!.....&...p.......".......@.......................................................................D.._....@..d....................................................................................@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data....d...P.......0..............@....reloc..,............6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\Registry.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25088
                                                                                                                                                                                                      Entropy (8bit):6.16866702253594
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
                                                                                                                                                                                                      MD5:2B7007ED0262CA02EF69D8990815CBEB
                                                                                                                                                                                                      SHA1:2EABE4F755213666DBBBDE024A5235DDDE02B47F
                                                                                                                                                                                                      SHA-256:0B25B20F26DE5D5BD795F934C70447112B4981343FCB2DFAB3374A4018D28C2D
                                                                                                                                                                                                      SHA-512:AA75EE59CA0B8530EB7298B74E5F334AE9D14129F603B285A3170B82103CFDCC175AF8185317E6207142517769E69A24B34FCDF0F58ED50A4960CBE8C22A0ACA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..]...]...]..|R..]...]...]...Q..]...Q..]...Q..]..Rich.]..........PE..L...PxEN...........!.....H... .......#.......`.......................................................................i.......f..P...............................<....................................................`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data........p.......X..............@....reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\System.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):10240
                                                                                                                                                                                                      Entropy (8bit):5.850825628811053
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:IDO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:TKAFERdlxhGRYUzqZaf
                                                                                                                                                                                                      MD5:7D85B1F619A3023CC693A88F040826D2
                                                                                                                                                                                                      SHA1:09F5D32F8143E7E0D9270430708DB1B9FC8871A8
                                                                                                                                                                                                      SHA-256:DC198967B0FB2BC7AAAB0886A700C7F4D8CB346C4F9D48B9B220487B0DFE8A18
                                                                                                                                                                                                      SHA-512:5465804C56D6251BF369609E1B44207B717228A8AC36C7992470B9DAF4A231256C0CE95E0B027C4164E62D9656742A56E2B51E9347C8B17AB51FF40F32928C85
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.............................S...........Rich...........PE..L.....pG...........!.................(.......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...?........................... ..`.rdata.......0....... ..............@..@.data...\....@.......$..............@....reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nst5A0C.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1646174
                                                                                                                                                                                                      Entropy (8bit):7.782492820242828
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:su6QvwF0DBQcp7wSXXpW43NVyM3NNJ5Okm:qQvF+YwAIGz3Okm
                                                                                                                                                                                                      MD5:805920E70DCCF7812F54015AC98D2D03
                                                                                                                                                                                                      SHA1:2912DE94662394F9461BBBE781CC3EB4597B957E
                                                                                                                                                                                                      SHA-256:E57B7CF635EB067F75CC8EAE6B33CB3882041AA4128EC46460C6BD1A7C0F9264
                                                                                                                                                                                                      SHA-512:515C86D81307187D27D685B380A00416BDBD0494D1BE6C58AA09D4CD262D6254BF992319719F63AD2C3EACD1E46C74D1DC4C0260A99B000F76FE9C40F8201F18
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:........,...............4...U...........g.......y...............................................................................~............................................................................................................................................................................*..j.......................B.......................................................................................................................w.......B.......................................................-.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsu5B45.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3744237
                                                                                                                                                                                                      Entropy (8bit):7.107780927813367
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:98304:91maY0MgwsDdFw0VEhRXtT0KqfHhpFKLZc9b6fHNmiQMOI8YBfsu:maYYwsvwZPXtYKmBpdbWET+
                                                                                                                                                                                                      MD5:F7CD1D4E4C9897A9D5858BCBBF4F9C8D
                                                                                                                                                                                                      SHA1:659467931C4F26B1B4B1A766E9C5341A335153DC
                                                                                                                                                                                                      SHA-256:93ED031A4ABE02C9AE84CC1CECE31FC015995C317627E04B445595A0C03F36BE
                                                                                                                                                                                                      SHA-512:EDC8B7C137BB8F36CAB6A9C872A8665C949CED23E5ECC52642E2558E50250096BE0EB7F93688C5507280DE618E1BF055517FFBACDA51ACD67117D018CE38AAE7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:........,...................4...........G.................................... ..C ......................F.......z...@.......F...,............................................................................................................................................................................1..........B.......................................................f.......................W.......................Y...............g.......................W.......................................j.......................W....................................................................................................................... .......W.......................................................).......................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\NSISdl.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):14848
                                                                                                                                                                                                      Entropy (8bit):6.042975836390264
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:/4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12FgszA:/ysdM80dCI5a2LsQ5IlPNRY00AlAbU
                                                                                                                                                                                                      MD5:A5B84D250794433DB5A2D26F34699DD9
                                                                                                                                                                                                      SHA1:BC06ABCCF6A4783973EC11B6766B43B4A265820C
                                                                                                                                                                                                      SHA-256:96F3357A024C549D7CB9E6447B1A56A2A8029B4F12E6E597428E68620761C5E0
                                                                                                                                                                                                      SHA-512:121D67F85A24096799ED913DCCB64EF65D9479F98A6D88C2A0E05F05A65F460D557C5FDFE2C42A0A61B9CBAEDD9B7031978111A2713250A89848AB4F3BB4CE84
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Ht..H...H...H...Ht.H...H...H...H...H...HRich...H........................PE..L.....pG...........!.....&...p.......".......@.......................................................................D.._....@..d....................................................................................@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data....d...P.......0..............@....reloc..,............6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\SetupHelperGB.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):109432
                                                                                                                                                                                                      Entropy (8bit):6.488111778836435
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:u6L4wfzGPnGWS562bthxJmRGydoKLknTvpxA5sHcS1VqYwCaW:u6LbfUnnWFJmgoLkzpC5s8UVqNW
                                                                                                                                                                                                      MD5:2E7E6956B137F083FE37FC4857BBA754
                                                                                                                                                                                                      SHA1:3B175387719FAEA3A2610308EF4C9357DE18D0D8
                                                                                                                                                                                                      SHA-256:23F44F3117E1DC0CB188460249D7C5691DD24152A3C7AFDC4D80F42E439EB1D6
                                                                                                                                                                                                      SHA-512:AC8E6FCD389CD4E73AAF20F4997A82E4257448E81AA64179CB3CC996A480A78630A49A8F3EDEF4D3D68425DDF47131B0FA486CA2E6B0432F5C87B64CB65A94ED
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.=T3.S.3.S.3.S.-...7.S.:...$.S.:...A.S.:...;.S..x>.2.S..x(.".S.3.R.E.S.:.....S.:...2.S.-...2.S.:...2.S.Rich3.S.........PE..L......P...........!.................c....... ......................................~`...............................U......TL..........................x............!...............................A..@............ ...............................text............................... ..`.rdata..l6... ...8..................@..@.data...<G...`...$...L..............@....rsrc................p..............@..@.reloc..T............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\System.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):10240
                                                                                                                                                                                                      Entropy (8bit):5.850825628811053
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:IDO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:TKAFERdlxhGRYUzqZaf
                                                                                                                                                                                                      MD5:7D85B1F619A3023CC693A88F040826D2
                                                                                                                                                                                                      SHA1:09F5D32F8143E7E0D9270430708DB1B9FC8871A8
                                                                                                                                                                                                      SHA-256:DC198967B0FB2BC7AAAB0886A700C7F4D8CB346C4F9D48B9B220487B0DFE8A18
                                                                                                                                                                                                      SHA-512:5465804C56D6251BF369609E1B44207B717228A8AC36C7992470B9DAF4A231256C0CE95E0B027C4164E62D9656742A56E2B51E9347C8B17AB51FF40F32928C85
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.............................S...........Rich...........PE..L.....pG...........!.................(.......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...?........................... ..`.rdata.......0....... ..............@..@.data...\....@.......$..............@....reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\registry.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):16384
                                                                                                                                                                                                      Entropy (8bit):6.15541350371607
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
                                                                                                                                                                                                      MD5:24A7A119E289F1B5B69F3D6CF258DB7C
                                                                                                                                                                                                      SHA1:FEC84298F9819ADF155FCF4E9E57DD402636C177
                                                                                                                                                                                                      SHA-256:AE53F8E00574A87DD243FDF344141417CFE2AF318C6C5E363A030D727A6C75D1
                                                                                                                                                                                                      SHA-512:FDBBEDCC877BF020A5965F6BA8586ADE48CFBE03AC0AF8190A8ACF077FB294FFD6B5A7AE49870BFF8CACD9E33D591BE63B5B3D5C2E432C640212BDCD0C602861
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{\g.?=..?=..?=..]"..8=..?=..#=..:1V.>=..:1U.>=..:1S.>=..Rich?=..........................PE..L...s3.I...........!.....,..........4........@...............................p.......................................F......`C..P............................`.......................................................@..|............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data... ....P......................@....reloc..H....`.......8..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{32DE70BA-1395-4dff-A45D-DE76DE00B289}.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1177688
                                                                                                                                                                                                      Entropy (8bit):6.566981597578591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:hmAickpYIlJwnR4F9BMt10HLXZSOzFeCfGCEXkWE2ayCMqM02yEhmAS1SD0YyqTY:n0YIlJwnR4F9BMt10HLXZSOzFeCfGCEM
                                                                                                                                                                                                      MD5:4A21ACD5FDB8E006E5CCFB259B557106
                                                                                                                                                                                                      SHA1:146CA6B76B8BF54E7C640D46AF353E9F84423972
                                                                                                                                                                                                      SHA-256:63360E5CD4806E6711E49878ACE346136AE829AB4EFA6C354753860E9A02BFE9
                                                                                                                                                                                                      SHA-512:A4C1023C138FD1E8CBB31E8BCDB65A16EE8D7518A6BE44B127A585DE66F19DD82B43FC4953FD68C276763EBBE6CE5152970A524257218A961A0C862F16BF7E45
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...ue.ue.ue..*t.ve.|.w.Te.R...we.R...fe.ue..d.k7f.}e.|.f..e.|.a.sd.|.p.te.k7v.te.|.s.te.Richue.........PE..L...g.vO...........!.........................@...............................0..........................................A..............................X.... ..\....F..............................`...@............@..h...l...@....................text....,.......................... ..`.rdata..1....@.......2..............@..@.data....w.......R..................@....rsrc...............B..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{40FDEBEB-AB66-4601-98EB-C4DE74916AE9}.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 213427 bytes, 1 file, at 0x2c +A "7z.dll", number 1, 12 datablocks, 0x1 compression
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):213427
                                                                                                                                                                                                      Entropy (8bit):7.997611527006153
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:3072:ZPx9oLEP6UF3FN1lm6zjRiJagudaE6Hdo0s+2no/WTYEeq9z5IGsfBxNt6AeD:ZPx9oLC5FVVAJXudaE2KnosYJ8wxN58
                                                                                                                                                                                                      MD5:959BECB9902B8CBA0C02E93F79ED6535
                                                                                                                                                                                                      SHA1:E3C78D1CEACA1C581AFC61BCEAB0033D321B30BD
                                                                                                                                                                                                      SHA-256:028E84D1F68F2D6AC617F3FE4B08D2AF7FB94931132380494A2EB92750A50CF6
                                                                                                                                                                                                      SHA-512:9537AF6F840DE62FBF5282C453CBD7D22DEF3EF93AEDFA6B85FC0CA1644AF278D5B65DB0568A54D865EF02F3E993973C5824C844E03A6129792C88410EF0693C
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MSCF.....A......,...................C..................Av. .7z.dll...4.yM..CK.}|..8>..$.d.,d.(.B.....UI\...&A.!$!B.^u.[k1.IX.l..8.-z......._....]bI......QO.A....=...^.....~|43s^......u..$g.8N..u...9............)..../....+.X....G........C?.e......C..<.]tgE...t..7.....kcM...{]......L....Yf.3....M..b...Yhi........;X.c....}/z.....0.....O..l.;...OM.8....<....... b...=....]xr.$.1.`.f......x.5%r_....D.u<.....v'r...$.W7C._.\.?0..&C....>.......y._b.......o.....=...'bc...'......(..=.....w5<../-...~U..14.9...'^.^........7p........._A........?O.(..U..X.r.,9..8.....''..>.W...K.8~..;*.2`.."G..).q.^.Z4...._...K....Q.-p.;.@P.J.`...c..W[.c;df~...Pv..P.I.K_^.twG..Y......j..(..?.....N.6.$..`.F..b..z.<.3)....i.er{....K.w...6L$..B`.....-.1......p....,n.'.^....k.r...t..O\C...S. ....i..3..Y..2.C.".k;fO.Q..jm.>...*.o...~=jm/......Q>w....E.|...9.|3.....=..l%8..7... {.Z(...t."..hs.5W/}j...o+X2Cz:...8..8.{..:wx.....q.K/.9.^.K/.:..9.....a.....[

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{68EF064C-3B63-497e-A48E-EE0231378DCB}.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):152799
                                                                                                                                                                                                      Entropy (8bit):7.99879211153661
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:3072:sK/zHx86nzLMMDj99IJVK+CUlXC7Kmkfj0mTAWMCGsI4zS0wwg:sKzx86zLMMD5mPzekfj5FMC/IiSjwg
                                                                                                                                                                                                      MD5:7CA3EABBAE526A7D31752F0B34BDF3D8
                                                                                                                                                                                                      SHA1:D3E9993081E9D17FC53E0A2079425A32F6A64A7F
                                                                                                                                                                                                      SHA-256:BD55FE648CB7C8A80D0DB1235EB431141EA4655EEDA3910FF3CBE263579D330F
                                                                                                                                                                                                      SHA-512:A2AADFEE753A04483BD0D898DA4B652901B88DF5955CE8FBAB8B91FE1CEF5A2068B95C3BFC6D76A6FE5E6A5384B5ACF48486BE73E31F39BDE623633D586D1D81
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:7z..'........T......#..........g.....]....D.....%..k.I...d.4.;tK.....f.*........$3\.A.igyd...*..w`2.gE..".U....,(.?..&......$?.+...|:.<...%..h.|......^...)..J.G%.l.L..I.gR.....w.@7..&i,..N~...q9..*~f....K.<\.;&.n..M.d..a....++..R;.Cl3..g.|.....PM.".&!....EHc..2pa..t;.mIU.lz.....u2Yj4k..=.`b.n.'........HP..9#+j2..{xf.).b..G.P.c.Q.(A.|$..`...+.A...ve$...4...r...x.......".j.S=.h...z.....xe.....K3 ..wz].+..V..~Z.t........0..j.D.......W.N....f9..&g..X.V.../...k.J.Q.S+...Bn5....N.a..{..;_#.vU.6.}?....@b..9.%......x..&..D..`*.$h....M..e.F..:.u.M...._.Y.V...M.....'..MT..;..e.Syd....4......O..m.u..)..p:%tIzj....i.N.w.*.:W. F.0..inX..Qm.A..t..._.Qu.\.@..B>.V..~8F.[|...7.8..+..`.....5.3.(..Eu..TV...F.L.......>..q_a..K..y>.....\.|9...y.!L..3..N&.:...c&.........:h..h>.H. .....\.^.."....M.%O..7.^......T.\.5...(G..}j..|......:$\.I..\...:'z..G9.T....rO..................W....X...C./...2.F........$.....H....z.N.B[yy.....%...R.....Y.^*..i^.i...7

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{786DF1B6-83F7-43fe-8CAF-75FCED58443B}.tmp\7z.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{814E26AF-27AE-4e38-B1C9-177FA34CAFA9}.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):392961
                                                                                                                                                                                                      Entropy (8bit):7.999518664058607
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:MjciTzRE1eGcN9A097Q5Diw0PKIHVTKAzNhbm5RQTcCCm:WPKol9d9twaHVTKAzOQTX
                                                                                                                                                                                                      MD5:20504F4D335ECB55B44085F8FA59825D
                                                                                                                                                                                                      SHA1:2B04705117DE7CF59DD57CFAB5BD42B9C65ECAC6
                                                                                                                                                                                                      SHA-256:FE076C937B0319F4C16130898C36DAC271C7C7D36FBEE28133949F8BAD22184B
                                                                                                                                                                                                      SHA-512:CA8312C7D4F03BAAB168D8699C9369146CC046A77A39581FC15114FDE24224C6D547A7EA1A85E8CF18200252874FE1158152F3BA645700AFB709113E4DEDA3E9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:7z..'...Qgy`O................{.{.n..$].&..p.........../D.|..(....U..)..B.s.Q....L...Bf...2f..'.6...gg.D.....(.[.[...1.Ic+...,.M.cH.-,.z......"...\[50...k...N.V3...(,vb...uFx.BKF.vG.4.r.NG..9.B....$n....._.....w."..w...>..}.v.GG.WhA.....[9j>...2.6.PF...G...vX.D.d.....?.......eD....Z.;..|~2.m..i.<.T...B..h.5...V....k...y.(l....(yK_.R.3.....mg.h.R.L..r...(.....id .#2.u=.........L.0|4.2...-h.o...*.\.W.X.5.j.T}...\.|[.).(m7"[.3.v.. 9...x..<U..Vw!.s..zv.>..N..TQ.!T.Y.-....X.c..uk.M.*`.|....4...5..)X.B'....'..Xhl..a..ON..>.d.w1../.....1..I.4..F.....z:})+.....`..U......J..YI.j.D.,.EZ..v..M*.m.....z.......3..Gr.K....c...'.:.....u<..L...Em...'.@.Nw.U|.."9...P.S..,......1.R.."...V.........hwY.3rW6.. ..8s.u3..$.?p.S..............N.:...p.....S...].|..f.....Q.h.k..FY..'0...L.\.g.Z.....0.....7...2.k....\6.X.%%21W.v.1T....[./..M ....m.JE(T.M.7..B...Gp...R...k....n.l......w....(....Rz.M..tR.t`F..5.*........=..f.W..YV..,. L.K...l.@TZ.'.Z.P{...v..O~../_...c.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{A61312D5-DDEC-48d5-8CFC-4F03781447A1}.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):12042
                                                                                                                                                                                                      Entropy (8bit):7.98360030040336
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:BfizEnYi6yugf59kbVj11o6LHQU7t9KqWXfE4IJS8ZvlE9qRBGxfj/fl:BKzwaC59Uo6zQYt97WuJNZvlem8xfbN
                                                                                                                                                                                                      MD5:AFD4E227874CA2557C924860755505A9
                                                                                                                                                                                                      SHA1:978A6B793BFD66712B76B7AEE2AE858ED78FD319
                                                                                                                                                                                                      SHA-256:3A48D6C8104496B0DB6C356379165BA362375EEA6819E81B5177B4ED435B3522
                                                                                                                                                                                                      SHA-512:7B65DEEC2D9518E325DC558994D4D1FBD5BD94595B8B62140BD3368CFBDAC35BE74D3426CB5A3D0D6B4F1AB42543BFCBE518294E69FABAA266B152D76639ABDC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:7z..'...-J..........#.......Q....n.-.]....D.....%..k.I...d.4.;tK.....f.*........$3\.A.igyd...*..w`2.gE.."....(RK....../U....$L_...z7.?..\...4.GL...5...E$,L...Kq...k~...+!F2D../...Ou?.............,.."XzB..,h.\].+................f.e...I[..+.#..4..(.a...H*%.....pt..-....e.2.v..V(.j....W.<W.zz.Q......c..I7.\...|4*.[.l/@X...t.3.....s.<D.E.U?m.....C.%.t.*..@q.D.N.P.w....1..O...1..U(..Z.#..3Sm..#...;.....,...+s'.Y/..c)c...,UjQ\...~2..23y..7.......r......k.-....}kUO....6..}:......b.U..S,.`/..|..#..j^^.*..Ge..#....f..k.Y..|...%."......tC.g&E....ze.#......4.4 9.Inj..a..!@..J.t..F..).3]..y)$..........B.?}..F....89...#\..+Uvs<.@...W...ZEs..^./..B..'.0.-.VP..#..8....U..0*.P..?%..f.MH..4.....?..s.8V.U<..3..@.....1...Yp.@dHj.VV....9.......V;.".>-......+'X...F.W..:.k....X$.B.UF9.Y\...._Y...vkx!RL.......c..g..[......WB....S...8.c.2.......7.....e)u....f.....ov6..;.0...Y......2..T.1..,.Cm.y.].....3..'.....N..m.nS.r_W"..M]............y..3....<..

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{BEDDD4D5-5919-4f04-B57A-4530FF46C491}.tmp\defaultskin.ui

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):190105
                                                                                                                                                                                                      Entropy (8bit):7.876379680368982
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:kjlj50A/p9fDAY4Pz3veaFjrJXo7blC47kbYKTaTZV22DhCF0dys:+jL/p9fDAjrvxnJXKlCY3TZV2C+0dys
                                                                                                                                                                                                      MD5:B34EBD51C6492553F37E11A38861416A
                                                                                                                                                                                                      SHA1:1EB4405C0B03EB9611F5C0AECEBB63CC571543E3
                                                                                                                                                                                                      SHA-256:532B0D95829BF64F065F76CBE8F98B698C81E53AB9595083C946373E712E3F05
                                                                                                                                                                                                      SHA-512:F3D33303D60BE93366AC337A6CB17DE6EA6A5E2749DB6A1989298497EC631E80997438D6D2F5FA44850513BD48BF2D23AD2B3F95C89D65F608A6EEEDC608BE7E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK........F..B................Common/PK.........Z.A...............Common/360Safe-16new.png.PNG........IHDR.............(-.S...:PLTE..............2..3.#:.#9..$..........4L4M...>,?n$6_.!K1F{.|)."L%7d...&7`."K......!I.q...<%7c$6^...1G{5N......,@m&7a.......(I.a..../..:#.....D.B..N....)K........v..1..AYe.,8X%2Q`m........7bo..a-.....6....0.......+H~.;.."dr.....K...j.hu.(..!.....et.gu.hv...mz.Lam.;KpP..<Jo....%A..6.e$......hu.....{....&..gu....T.._.V..X..6Dgl.....w.......o.........|..%@.%@]..gt./...{.........].....[..`............/=_Q.....K...........@c.......Z......H.....'D.......)6U.G..3.c%.d...%1N..x..[....l.....m~...;...@u.......................$4Z%8e"2V!0Sfs..%A.&B.........L....tRNS9.9.....;53.X.7.....IDATx.].e;.a....c....t..tNwww.t.4c......y...x..>]......\..hk,.+....0............tAx$Tt-l.g'...Z:.2b..g..].......:.V/O^.0........8.:..$.....\.H.IxY......./.>...~.....X.......f..S..0..^..@......py.....f..C....ml9.Nn..I...R.Y.....\..J........mg.....:...@...

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{BEDDD4D5-5919-4f04-B57A-4530FF46C491}.tmp\miniui.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (586), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3972
                                                                                                                                                                                                      Entropy (8bit):3.7261411544758056
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:uqaDiDjTHCIDm8Scc0LoSd8jVcxsuwScd0+807deAYRgP8:8uLJDLo7VEb
                                                                                                                                                                                                      MD5:D28462B570A9BE65DFF946528F7FC699
                                                                                                                                                                                                      SHA1:1F295641F06569F225A5E73D24E4C7F26144E371
                                                                                                                                                                                                      SHA-256:ED9C12AA4079376C8E2037D8563F7B04CC3829094D5FE87F83831249FED64F96
                                                                                                                                                                                                      SHA-512:E656E4DE29A4910BE95714C317C5943B4B21FE2BB79EC3FC54A81B74F8664E5E3D22059610B24EC9BDA97CE663792E25CAEE9A92D44193B796E88D5859D253F4
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=."..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=."..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .M.a.x.i.m.i.z.e.B.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{BFC92D40-ECAB-4ef4-AB8D-213598EBBADE}.tmp\360Desktop.setup

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2818
                                                                                                                                                                                                      Entropy (8bit):3.8559297372687213
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+sO0rEMpNgwp2QaXlUrMlUC4PvNL2mrErXflzlfotMEyEd1GMZZBBCtGcsZBBCF:9KgwTaXjKWXfp9OMBTMZZCIcsZC4kZCw
                                                                                                                                                                                                      MD5:00F3065E2E29E877451434AA09D22208
                                                                                                                                                                                                      SHA1:8E2B2D93EF47F4B2B3E9F832981791A909C45C7F
                                                                                                                                                                                                      SHA-256:44CE1F2F7F9151376E3FC61E55C1307244ABA0124CF39FE184DECE73F2D7504A
                                                                                                                                                                                                      SHA-512:8C31B6262C3CF6F0D7A5288AEA358B0D7866F9E93BAD35AB2CF7AD0A0BB6AD908F03E6AB526A1268AD7803B9A75ADE3DB5D8DCED56920FEB5D3D4484F277EABA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.>..... . .<.M.a.i.n. .N.a.m.e.=.".3.6.0..[hQLhb.". .P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .E.x.e.c.u.t.a.b.l.e.=.".s.e.t.u.p...e.x.e.". .T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%..[.". .U.n.i.n.s.t.a.l.l.T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%.xS}.". .M.i.n.i.m.i.z.e.S.p.a.c.e.=.".2.0.0.". .R.e.b.o.o.t.F.l.a.g.N.a.m.e.=.".{.0.9.5.4.A.A.0.5.-.5.D.7.1.-.4.3.4.a.-.8.0.A.6.-.1.0.A.1.A.F.4.1.F.5.C.C.}.". .M.u.t.e.x.N.a.m.e.=.".3.6.0.D.t.I.n.s.t.a.l.l.e.r."./.>..... . .<.A.p.p.l.i.c.a.t.i.o.n. .M.a.i.n.A.p.p.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.". .V.e.r.s.i.o.n.B.a.s.e.F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e."./.>..... . .<.R.e.g.A.p.p.P.a.t.h. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.A.p.p. .P.a.t.h.s.\.3.6.0.D.e.s.k.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{BFC92D40-ECAB-4ef4-AB8D-213598EBBADE}.tmp\Plugin.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3902
                                                                                                                                                                                                      Entropy (8bit):3.5557288835319474
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+JVZlplUZlplfZlplEZlpljotElpl9ZlpljvZlpl9Zlplyn5ibEn5+vEnvlmpgS:dmfGp11p1FAfpE1otR3omfGpWA
                                                                                                                                                                                                      MD5:2DD2E9A30A526F127ED55D471E414368
                                                                                                                                                                                                      SHA1:80EE609ADD556B87E95BBF1C77ADFD0FE2DB05AD
                                                                                                                                                                                                      SHA-256:FF9B5847CBCDB3E9DF84505057E7CD36317308944526EDA5A042C3C81492CCE1
                                                                                                                                                                                                      SHA-512:CF85057B916932FE0CD7CB2FE0A183873C41868CD6EA72F13C7AB2058E37F29EA358ABC43B11D2BF9E086047970D43D2B974D8951D9D37BD24F10BEE041E0F1E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.P.l.u.g.i.n.>..... . .<.B.e.f.o.r.e.S.e.t.u.p.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".3.2.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t.6.4...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".6.4.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.M.W.e.b.P.r.o.x.y.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p.M.e.n.u...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>..... . .<./.B.e.f.o.r.e.S.e.t.u.p.>..... . .<.A.f.t.e.r.S.e.t.u.p.>..... . . . .<.I.t.e.m. .T.y.p.e.=.".S.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{BFC92D40-ECAB-4ef4-AB8D-213598EBBADE}.tmp\Register.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2256
                                                                                                                                                                                                      Entropy (8bit):3.5953053564026893
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y++V47t7uJWg3oMDgVir4pMQaRkqcPsAwY:63qwvY
                                                                                                                                                                                                      MD5:35AA95AC9AC71D0FAD5E19C511FFFD2A
                                                                                                                                                                                                      SHA1:ADEEA5639F4C9558C44E73188CBD24C207FA7012
                                                                                                                                                                                                      SHA-256:7F9E467EF207FFB4F524C93AF58FE5E9718FF2F0BB2A7B8359FE44AAC1DE509D
                                                                                                                                                                                                      SHA-512:9ACCC1BDDDF6B4AA4DE212439D415A04A3BCA96F1F21B90A8CA9D65C88177DF91EE001DC940A57B61A5DAA9B70EAAD86BA76712780DCCE31376CB6580EE9DB98
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.e.g.i.s.t.e.r.>..... . .<.I.n.s.t.a.l.l.>..... . . . .<.!.-.-.>.......<.K.e.y.I.n.f.o. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.3.6.0.D.e.s.k.t.o.p.\.s.a.f.e.m.o.n.". .>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".E.x.e.c.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".S.i.t.e.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".I.E.P.r.o.t.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".3.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".M.o.n.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".U.D.i.s.k.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".D.r.v.F.W.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... .

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{BFC92D40-ECAB-4ef4-AB8D-213598EBBADE}.tmp\UninstallRootDirFileList.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2330
                                                                                                                                                                                                      Entropy (8bit):3.4422158512260266
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:y+hUlzbb23QmSt2n16n1MHssRJlACXApDXeXyVBVaY636BhNvVPc:WUUu1i1NerACXAleXsBpb6
                                                                                                                                                                                                      MD5:55EA164B6BB418440F4659D7AFDE63EA
                                                                                                                                                                                                      SHA1:A54EF67DA77A369803FA4DBDFC3FE82A3864B622
                                                                                                                                                                                                      SHA-256:991B63FF2711AF2A635C9FC01FC296BC0A30B0ACA3CB0778E798349449F4CAF9
                                                                                                                                                                                                      SHA-512:68378479009533964F60AD7E3E515ABF573FB2E306231B9C3E867FC3B663A50DBE8A6DC7C0B1FB3453B7B69C9C52C50345F1719EE0CEF63C31BCC40E548FB1BB
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t.D.i.r.F.i.l.e.s.>..... . .<.D.i.r.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".B.i.n.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".C.o.n.f.i.g.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".s.a.f.e.m.o.n.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".b.a.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".L.i.v.e.U.p.d.a.t.e.L.o.g.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".u.p.d.a.t.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".D.T.F.e.n.c.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".l.o.g.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".m.o.d.u.l.e.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.C.a.c.h.e.". ./.>..... . .<./.D.i.r.>..... . .<.F.i.l.e.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".7.z...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". ./.>..... . . . .<.I.t.e.m.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{BFC92D40-ECAB-4ef4-AB8D-213598EBBADE}.tmp\filelist.xml

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):82552
                                                                                                                                                                                                      Entropy (8bit):3.7230656395395596
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:15GYKRpRvAERQ3J3HzoE4oltGT8r2rchp+r+8D9NLx:15GtRpR7RQtrHa8r2jFD9NLx
                                                                                                                                                                                                      MD5:C9B3EF7097B1EB528A71EAD78B2CEEEB
                                                                                                                                                                                                      SHA1:803FC5D048BF9B6370BFCA85ABB0CC80B0701CA2
                                                                                                                                                                                                      SHA-256:8DBA5E7360352A2317F34F5C5CB7D712BD417F82D2B11C4C395695B5EAC049F1
                                                                                                                                                                                                      SHA-512:9038E006FB468AE4ECCDFBA131A1CB89200D225C5A8B4E4D764EFC279C01BF1ADCBBDB90A8F7065CBAA1BA561D03E892CC2B964E18A8B395BAF2182A4861B1AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.F.i.l.e.L.i.s.t.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".7...3...0...1.0.3.5.". .S.i.z.e.=.".2.7.1.9.6.8.". .M.D.5.=.".2.0.E.6.9.F.7.B.5.5.E.A.4.F.7.A.4.8.7.3.6.A.1.9.3.8.9.B.D.2.F.9."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".2...4...0...1.0.4.1.". .S.i.z.e.=.".4.7.8.0.5.6.". .M.D.5.=.".8.7.0.1.0.9.6.D.5.7.2.C.5.6.D.F.7.C.4.1.F.A.1.9.8.7.B.6.9.6.6.7."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.n.e.t...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...2...0...1.0.4.2.". .S.i.z.e.=.".2.7.5.2.8.8.". .M.D.5.=.".E.6.F.F.7.6.3.A.4.A.C.9.1.2.3.2.9.7.9.5.6.0.5.2.5.E.1.2.E.4.C.3."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.P.2.S.P...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...3...0...1.0.8.0.". .S.i.z.e.=.".7.2.4.6.0.0.". .M.D.5.=.".6.4.0.F.3.3.B.0.0.5.9.E.D.6.E.B.8.

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{FFB457B7-D39B-4777-A970-75B9F9B81322}.tmp\MiniUI.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1177688
                                                                                                                                                                                                      Entropy (8bit):6.566981597578591
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:hmAickpYIlJwnR4F9BMt10HLXZSOzFeCfGCEXkWE2ayCMqM02yEhmAS1SD0YyqTY:n0YIlJwnR4F9BMt10HLXZSOzFeCfGCEM
                                                                                                                                                                                                      MD5:4A21ACD5FDB8E006E5CCFB259B557106
                                                                                                                                                                                                      SHA1:146CA6B76B8BF54E7C640D46AF353E9F84423972
                                                                                                                                                                                                      SHA-256:63360E5CD4806E6711E49878ACE346136AE829AB4EFA6C354753860E9A02BFE9
                                                                                                                                                                                                      SHA-512:A4C1023C138FD1E8CBB31E8BCDB65A16EE8D7518A6BE44B127A585DE66F19DD82B43FC4953FD68C276763EBBE6CE5152970A524257218A961A0C862F16BF7E45
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...ue.ue.ue..*t.ve.|.w.Te.R...we.R...fe.ue..d.k7f.}e.|.f..e.|.a.sd.|.p.te.k7v.te.|.s.te.Richue.........PE..L...g.vO...........!.........................@...............................0..........................................A..............................X.... ..\....F..............................`...@............@..h...l...@....................text....,.......................... ..`.rdata..1....@.......2..............@..@.data....w.......R..................@....rsrc...............B..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\AppBreathLight.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\DtWebmailHost.nxdb (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\LoginAlertSwitcher.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\MiniAppdata.xdb (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\SelectMusicConfig.xml (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\douban\douban.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):5144
                                                                                                                                                                                                      Entropy (8bit):7.924303008935322
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:jSMllcHitlIxv9vk7C1+I4wWHLihk/x/XRzAd/7rtYWcuS4TV/zoCQG:jSHIIHUCD4wanAdvti4TWC7
                                                                                                                                                                                                      MD5:278C49FB3BC908F88B2FCF0C59A3EFA4
                                                                                                                                                                                                      SHA1:4DAF8D31656B057973261DA592D210486B2A5E63
                                                                                                                                                                                                      SHA-256:64AC53712D212CA020E4FC8D5DCBC262AEEA36084647079D0B3F9826BC0D1BB9
                                                                                                                                                                                                      SHA-512:623266DBDE05F850F99B8AB31239CF2183B620079D8E5D1CC193EFABEE527192BFFE90C3EC4CD2C96483AEA64E7A5F3A4DFBD98C35556BF254659FF17A2C57E9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\jingfm\jingfm.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):7971
                                                                                                                                                                                                      Entropy (8bit):7.956521088757676
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wauVFxHUELpeNDF8pW+ZYibvAmX:W50wzbxHpeGb/b
                                                                                                                                                                                                      MD5:E670AB623C433324324FEC4B53DAB011
                                                                                                                                                                                                      SHA1:82D79DCAE81F58EABD8EF76C17EC6057F13BD9D8
                                                                                                                                                                                                      SHA-256:880D829FC1F50EBFD4567F21D190966BB6283C03D5ABEA5C05753DD73726BF6F
                                                                                                                                                                                                      SHA-512:E206D1D4BFE38D2000AADB54E797F192A4DC364C24F53972D6FD64F975C6B68E01F85DD2BA3EE173061BFB02955231D9801362CAA729B8B15DB8EFA73391D8D3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\kugou\kugou.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8086
                                                                                                                                                                                                      Entropy (8bit):7.96318899322068
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wakANE0zB4bPD3FX2Xa+AjGLf+ZBHq:W50wZAN7qr/jGLfCBHq
                                                                                                                                                                                                      MD5:1752E6A102C825F40CAC0102CA4389D3
                                                                                                                                                                                                      SHA1:FEA1008EE4EBC636C20AA6E78145802F498FA4BD
                                                                                                                                                                                                      SHA-256:5A44CAEDAE5C4FBAAB8AF9FC71B320E2F85ACB879420DF4C4962D87226E8F7EC
                                                                                                                                                                                                      SHA-512:C436B3AEE7107478C93ECDC8FAA941F43DD830CC492073803D9420D91B0C1C077B437423E2A013DC46D11A26A549EC2751E903882097A54FAD4E82542D1BF036
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\kuwo\kuwo.png (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8115
                                                                                                                                                                                                      Entropy (8bit):7.965265564609039
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4waeV8OpYHbC8iBo7IDEeENYwWLTzmakArjP:W50wj9u8qIDEeENYZHvZ7
                                                                                                                                                                                                      MD5:440543B6F1CC1F444E6A5FE8E5247D09
                                                                                                                                                                                                      SHA1:0C3E16121D76EFDE609E48C571D90F711F84AB9B
                                                                                                                                                                                                      SHA-256:7EDDECC40D5206764122F3C5632DDA068FF6E20F8C2C043B3B596E9D69FF6507
                                                                                                                                                                                                      SHA-512:3EC7D77984AD04FB16ECADD83F0295CCDC1CB762C2C5877DEEE25D5CB1F32139C306ADF7A6D7D706F694A3AB9FEBF0E4E8500E2D7E8F9DE27ECC915C18EA61CC
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\WallPaper.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\bak\Config.nxdb (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):290
                                                                                                                                                                                                      Entropy (8bit):4.645472736563747
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6:TMVBdxdaT0x3OY0FgU3OY00mxFxpyRdL1Li3OY9WhblIW5:TMHdxdaToYgUHmxPudpLisZIW
                                                                                                                                                                                                      MD5:D4C64B72909AC4E1A9D967BAB4CBEBCE
                                                                                                                                                                                                      SHA1:C9E6212F312A0084112B8E909EEF04C28FD3C81A
                                                                                                                                                                                                      SHA-256:8ECCCE53B3E4F3A052D15C40391B883AEB5ED3B0F17750FC131D19A57EC6FDF0
                                                                                                                                                                                                      SHA-512:E260F51650C704BB8869CE0D4739F00C4D9EA53E14F58678E7760F0B0F930E8584162CE3C1851E100C3C8376656B459ABA71E8204ED4AC362A80BE24A91DF0C3
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" ?>.<configs>. <SEG sn="SettingCenter">. <ITEM k="14" v="3" />. <ITEM k="15" v="3" />. </SEG>. <SEG sn="FavItems">. <ARRAY k="ItemArray">. </ARRAY>. <ITEM k="NoImport" v="1" />. </SEG>.</configs>............

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\extensions\LoginAssis\app_stat.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\extensions\LoginAssis\loginassis.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\extensions\LoginAssis\update.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\import.fg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):78
                                                                                                                                                                                                      Entropy (8bit):4.367903661777143
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:L58BhYUyC2MYRAQHX5ov:uMUyCrYeQHX2v
                                                                                                                                                                                                      MD5:6484C6AC89C6DD619A9B1E613C77E66D
                                                                                                                                                                                                      SHA1:6462D4DCCA4ACC69CA0BF40C31AF4AF68F3BF29B
                                                                                                                                                                                                      SHA-256:1FA27708E6D3FFAE9C1090ABDD4C3514C1233008A66D94568F3A3E9E559EC1EB
                                                                                                                                                                                                      SHA-512:F5E4CB990E5F3BE1918BEB7056BA831C1C200E4D0B351224D28E4DAB23D3D279188573E3309F95333F25B56D4D701B7DE70FB2702558356055DD45230E8ED61F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[import]..version_opr=2..fullscreen=1..system=3..runpreview=1..shownewuser=1..

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360GameUsers\snap.jpg

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 968x594, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):260245
                                                                                                                                                                                                      Entropy (8bit):7.981838538263462
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:CXWH3fo3RWew5+WSY0+VdrQdRFsV+6jRqOQIYNe:CXkfGMew4W3jfrQQj97
                                                                                                                                                                                                      MD5:F6131F2C0C5DDD7849ACF29C8A5E5549
                                                                                                                                                                                                      SHA1:AFE63A494D32467FF49EE213A1C36DF2C2769074
                                                                                                                                                                                                      SHA-256:A4AC0C0ECB65A6086391EFBC8A4B50B621A13ED1C1E1B8D7395EF54CCBFA6988
                                                                                                                                                                                                      SHA-512:6A6E04F477B5E6844042BFDEFCAFA7680672F45B512BFA6BA7687C8A95EC1E3FC91C0BEE9726F866BCC85133DC110BCFBCBEA2E7EBE3AED5BDA76C26E54400BE
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................R...............................................o...........................!1..AQ."a..2q.....#BRSrs....$345Ue......6CTVbt..%.........&78Dcv....u..FG.'W.Edf....................................R......................!...1AQ.."aq..2.....BR...#3b......STr..$45d...Cs%.Dc..&6..............?.....mf......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HD..E.9.M..>.)Za.vV.:.ZB.>.[z9F:.u.........m.....~.O.....'...g.5..,....M...Ne..l..H.p...Z_..3..}...v?i.4.s/.g.].G..........,....M.....?..?\6......4...Af...o.>......|...'...g.4..0..~.~i.._....4..........k....CNGq~........n...s.G.T.>g..E'..}.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):4405112
                                                                                                                                                                                                      Entropy (8bit):6.54104069780479
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:kZoX2uGyQPd38V3ScT44Q6SrRaVWiXk+NolDH8k1VbAxwhvcL5b+xal50+pTRT3q:WndPd38VCON0+rk1Vbm5bEA0+7qf
                                                                                                                                                                                                      MD5:F1C9C0C1425BBCCF47C1AFB1302F59FF
                                                                                                                                                                                                      SHA1:24A0CE9D29449164B50F7C8B6BB50F130762A467
                                                                                                                                                                                                      SHA-256:073FD886ABC9132482C8B9B944473C08CEB8604187BBA3A5E4DAC0221C4C383C
                                                                                                                                                                                                      SHA-512:CE7E415A3ECAB14F3747D51C9619700D65141E3349C5E56E937D0A16BB6FECF2FA5295B3ACA95AAF9AAA954877CB422C5BE8A955E3FD2D8171736BD050AAA332
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...yn.P.................$8.........X38......@8...@...........................J.......D..........@....................<......p<..I....A.............."C.x...}.J...............................<......................................................text.....7.......7................. ..`.itext...(....8..*....7............. ..`.data........@8......(8.............@....bss..........9.......9..................idata...I...p<..J....9.............@....didata.......<.......9.............@....edata........<.......9.............@..@.tls..........<.......:..................rdata........<.......:.............@..@.reloc.. .....=.......:..................rsrc.........A.......:.............@..@QProtect.0....I..$....A............. ...................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.rs (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):695672
                                                                                                                                                                                                      Entropy (8bit):7.872174101935894
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:9iqXVf+i83kCL4fa4gfL4fa4gfyAb7QvzAuA1UmLpflEddb8b:kqXVl8nyAbUvMuA1UmBWD8b
                                                                                                                                                                                                      MD5:AFCE1572F712D14924A54D6C6D85A253
                                                                                                                                                                                                      SHA1:DC5D68D5F32CAF04F88875AA69AB3F0B62239513
                                                                                                                                                                                                      SHA-256:A7D817E4CC497496E98CF1463A0E490ECB0DFB83BEB9E2B21A23DA911D75F699
                                                                                                                                                                                                      SHA-512:25F611690B8133ACFEA262A902B76843AD0753599503D45232D02946ED0248A7CEE8A39C772853E512004AA93C3E657BF9D8B66D26BB36AD19011875DDBF7F4F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....ZP.................8...L.......P.......`....@..................................2...................................................:..............x...........................................................................................text....4.......6.................. ..`.itext.......P.......:.............. ..`.data........`.......<..............@....bss....|+...p.......D...................idata...............D..............@....reloc...............H..............@..B.rsrc....:.......:...N..............@..@....................................@..@................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\360weibo.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2473320
                                                                                                                                                                                                      Entropy (8bit):7.170882557492812
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:JrUM+KjQptQubmeGTU9taTqvyG0F/n2umcetnHaR:JKtQkmGc2Rcv
                                                                                                                                                                                                      MD5:207187DA1CFD94F8D927A6D6094A33AF
                                                                                                                                                                                                      SHA1:2BBCD15B440101F5781DB5F5178CEF8C0232CE3C
                                                                                                                                                                                                      SHA-256:BE964FA9736D7BDAD0C950FFF371197574A7081F488A884605C17010689CF877
                                                                                                                                                                                                      SHA-512:E3F32CA9805AE7267C399DEDC784E6A76A1A282A686490D02A32FFD39A719EDB49A3E07F7079709140A1EF3A21042267266A2D1F971881AC514D142F69D646AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D).t.H.'.H.'.H.''..'.H.''..'.H.''..'+H.'.H.'.J.'.0-'.H.'.0;'.H.'.0<'.H.'..<'.H.'.02'KH.'..,'.H.'.H/'.H.'.0)'.H.'Rich.H.'........................PE..L....."Q..........................................@..........................0&.......&...@...........................................................%.h.....$.4...0...............................h...@.......................@....................text...P........................... ..`.rdata..fL.......N..................@..@.data........@...`...*..............@....share..............................@....rsrc...............................@..@.reloc...n....$..p...:$.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\ExtNetIncrement.dll (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):285048
                                                                                                                                                                                                      Entropy (8bit):6.492512091199515
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:As8yZny7jGBbSLPdSP3JBI6jsR8Pym0OSahuJ+:zy7SBb+dSP3JBI6o8qm0O/EJ+
                                                                                                                                                                                                      MD5:39E18F0F619546380688A92AF44D654B
                                                                                                                                                                                                      SHA1:76D6E5065F188EA287D00BEB8B2C38C4F9631038
                                                                                                                                                                                                      SHA-256:3C2FFF93C150BB229FF1B71E8720CC18DEB9B69B1A0FCBFBE691256EFF3DEE92
                                                                                                                                                                                                      SHA-512:B53339E2C940A38020C48F3F9FD3925168CD7ABFB6B974A4E80FB4762FA8A9A028638FC0D904F4A8D0065F50C0CE9672CEC3D945C9B5146CC8D13B7C712C157D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$..VE.HVE.HVE.H_=WHLE.H_=AH.E.Hq..HAE.HVE.H.E.H_=FH>E.H_=PHWE.HH.VHWE.H_=SHWE.HRichVE.H........PE..L....#`P...........!.....T..................p...............................@......................................@.......T........................D..x........!...s.............................. ...@............p...............................text....R.......T.................. ..`.rdata.......p.......X..............@..@.data... ...........................@....rsrc...............................@..@.reloc..:D.......F..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\defaultskin.zip (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):89232
                                                                                                                                                                                                      Entropy (8bit):7.804803823752292
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:y55kBo8le0jvUXLH7STim62VC1A58PblX1XzJxUn5ucRGcZRX4:y55kBoDeI/STBB2A0x1jJxu5VRGcZV4
                                                                                                                                                                                                      MD5:0AB8A06150CBB0561E907976715CB447
                                                                                                                                                                                                      SHA1:71ACEACA41CDB176D9E6CCE7856B44A3D39C573D
                                                                                                                                                                                                      SHA-256:F160C8EFA5A2D1F42216403DB162BF0F205C716A5FB96522D1A573C28031191D
                                                                                                                                                                                                      SHA-512:D5D787AAF97E764BB7EE226CE33EC765C308D27BC4FC4F18EE3A9A3BFD766E964D052BE854B1F418340E4657DB858AD5EA950DEB6C37A9FCDA70A3667E43CF8A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK...........A................default/PK...........A................default/add_link/PK.........aA...x............default/add_link/bk.png.T{8.{..Q3,M....Q.....!...}n-Ns'IL.$....g...!..en..Sn1+....4.5#.vv.8......}>.....}...&.,.$.%...B^3w...7..,.&.?[f...x:....~......].\.c..../U8`...[.6-.8%..q.9......C.#....yQ}......X.=.^.D.IIDT..s...(6u...t.!....l.......f....3..U.a.bq.Y...5....._Q..}b?.]....6sZ..++.^...F.........*V3....t.c./..?}R...9..H.<H1B ...'&..X.....G.U.Z_Jc.>.._.k&.$$$\v.\.g1.cOxe^......{-tF..@.1,[...D....,l......+p.J.r.]z.....sS,=..Z..`.^FCQ....&".........}..F4.....?..i.Z. .... 'E...s.....0.#...Q....(..........v.....F..e0<.T8p....q;.$\...L...u~.]x...4z/J%./.\_4..#Dz.?S...\.M.4@.O!9'....K.G.9zYZ...?.....-...O...i..Bah'..YvR..e n.;#C.K.pTck..{U.....7...j.;..4`%.....<........$D...".f.....2@q.Gh...3Y@.G.r...P.}...N..T>..F.i..).........<6..>z..U.QC.Lw].9....,.!l.y......k;{...w)s..\.]s/jD.f}.....3........'Hb.e.....W.Kp-T\...Z .s..?.KT.r.B....

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\language\2052.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1592
                                                                                                                                                                                                      Entropy (8bit):5.57984884030076
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:Q+jUY4lo0tGhjg4URnvJgCWaiJm1Nob6AdtT4si2OaaNoq26AdtuQyskB0uPTn0O:rjyosGhMhRnSCM6g472F6DMcvTn0O
                                                                                                                                                                                                      MD5:A4CAC1232C683C6F12FE77D7F18E8982
                                                                                                                                                                                                      SHA1:ABCB5A0E26260EEBC4A24753496358E0D6CC2BD2
                                                                                                                                                                                                      SHA-256:F6D12D2742F2CAE90B9CC1EB2A51C81F793EAED9B6E3E18439F00EC74F1C7D9A
                                                                                                                                                                                                      SHA-512:5DF6850EB4AE88F6C137FF33591DF74DBBF921C65A87A416031D5CBAA332217CEAEE45EEC7D7373A511D1BC80FD9E414DC87881C82576E82B654E98D72530443
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.a.p.p.].....N.A.M.E.=..mo`.vP[....L.A.N.G.U.A.G.E.=..{SO-N.e........[.M.A.I.N.].....1.=..`(u@..c0R............[.L.O.G.I.N.].....2.=..R}.-N..........3.=..f.e.e.l..c.N.g.RhV.....z.T..........[.B.U.D.D.Y._.L.I.S.T.].....1.=.._ZS}Y.S....2.=..b.vsQ.l........[.F.O.C.U.S._.L.I.S.T.].....1.=.@b.g.R.~....2.=....R}.-N................[.C.H.A.T.].....1.=..S...Q.[.N..:Nzz........[.W.E.I.B.O.].....3.=.#...(W....eQ.[IN...#.....2.0.=..b.v..u.....2.1.=..b.v._ZS....2.2.=.@..c0R.b.v....2.3.=.6e0R.v.......2.4.=..b.v6e.........[.M.A.I.N._.T.A.B.].....1.=.._ZS....2.=.@..b....3.=........4.=..y.O....6.=.sQ.l........[.I.D.D._.S.E.N.D._.R.E.C.O.M.M.E.N.D.].....1.=........2.=.l..S....6.=..S..1Y%....N...S.^..Y.v.Q.[....7.=..S.^1Y%......z.T.Q.....9.=..S.^.Q.[.N..:Nzz....1.0.=..Q.[*Y.....N.....1.4.0.*NW[&{....1.1.=.l..S._ZS........[.I.D.D._.S.E.N.D._.W.E.I.B.O.].....1.=..S.^.e._ZS....2.=..VGr....4.=..N/e.c.v.V.P<h._...N/e.cJ.P.G..0G.I.F..0P.N.G..VGr....5.=..N O.v.V.P._{..\.N5.M.b.....6.=..S..1Y%.

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\language\current.ini (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                      Entropy (8bit):3.070031888400838
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:Q+elPVtClLtlElQalGn:Q+elqlxeldGn
                                                                                                                                                                                                      MD5:D45E9DDBE56A1DD7B58BD733BFE482B5
                                                                                                                                                                                                      SHA1:2C83B4D3CB08F08D1C3545FF50AE14F0B49A58DB
                                                                                                                                                                                                      SHA-256:52989F602299162773D8814D10C6A5A45FA86B4BDADF7295FFBA816AFE04CD32
                                                                                                                                                                                                      SHA-512:D24A4D96458E103B51F5A23DE3528DBA1BA216692870B1E4B41625BB0D7EFBAAEA5B8BC2A90E6CE25C14408F2B90A0EADDEEF45356E1EDB07A964AC04818F87A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:..[.a.p.p.].....l.a.n.g.u.a.g.e.=.2.0.5.2.....

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\sqlite3.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):423584
                                                                                                                                                                                                      Entropy (8bit):6.683424538324543
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:Yz0fZUselMRqlkPUyZWTQHkK67VTZ6pGBdmkRL6iH3/BoqnuF:hSyZC7WpGBdmkRL6ipo+uF
                                                                                                                                                                                                      MD5:4D1B78591D892A54DD795AD3F7336756
                                                                                                                                                                                                      SHA1:7935FB2758003BB3BBE9C58811DB71323FD66353
                                                                                                                                                                                                      SHA-256:2938CCE7F5716AF3D6317D1617DD3B2E8C212A11FD91DE95AE0713D8E2FFE0C2
                                                                                                                                                                                                      SHA-512:17A5D93430A39F55CFFBD892B89560710B082555D714EE629C5E399B386B3F5A30F6C47E202E3E3FE8637DDEFE2C98D0CABF8DD67D10A0555719A6F765129052
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.?..kQ..kQ..kQ..w_..kQ.yt[..kQ.ytU..kQ..c...kQ..kP.TkQ. M[.YkQ. MZ..kQ..mW..kQ..KU..kQ.Rich.kQ.........................PE..L...k..L...........!.....0... ......)7.......@...............................`......8&...............................|..W...Xw..<....0..`............`.......@.......A...............................................@...............................text...6(.......0.................. ..`.rdata..GS...@...`...@..............@..@.data..............................@....rsrc...`....0.......0..............@..@.reloc.......@... ...@..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360verify.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1664832
                                                                                                                                                                                                      Entropy (8bit):7.192460037805412
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:49152:pM8PwZX6D3RzFN2r5lkVEhRPT0I9J5MQPQExTLILmebfiG/USK8:pMgwsDdFw0VEhRXtT0KqfHD
                                                                                                                                                                                                      MD5:F9093B9504ABF8EE62BAF4B74D665841
                                                                                                                                                                                                      SHA1:15C04D62174A543070B3CDE000426FB82E053CF8
                                                                                                                                                                                                      SHA-256:AB4A4927295D2095458975046109896E03BECADEB62C106C13C734AB2A310022
                                                                                                                                                                                                      SHA-512:D958F581E5CBF9CD59205961A0AC30F96C2656FA0E625D986F6BEAD9D1E617D002019892FA465425290CF0DF5E508A31CF6FBBDCDBA6C4B63F5D4A61B7688130
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......V..H.u...u...u...j...u...:W..u....T..u..5....u...'E..u....B..u..5....u..5...9u...u..Gw....H.Wu....E..u...'U..u...uV..u....P..u..Rich.u..........................PE..L... ;.Q.................>...........U.......P....@.......................... ............@.................................4w...........,...........H..@....0.....0Z...............................................P..(............................text....<.......>.................. ..`.rdata..LS...P...T...B..............@..@.data....K..........................@....rsrc....,...........0..............@..@.reloc.......0.......^..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):947888
                                                                                                                                                                                                      Entropy (8bit):7.05706684193467
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:rXl7stOdRZQ4qrLZcycP1N/qTDUvSfiG/US:rXl7pbZKLZc9byTDU6fiG/US
                                                                                                                                                                                                      MD5:B8B17E96DFCB39621A7D886528D1FACC
                                                                                                                                                                                                      SHA1:BAC017451A2BCEB5EC5D4539ADE65AA718551D7F
                                                                                                                                                                                                      SHA-256:91F4A07C32C066C53017A35E382DAD5CB275669BEAC3C61A59FB767509D165F9
                                                                                                                                                                                                      SHA-512:EF988EA23B5142FE6C6BC51A444F637B194DF44B939055DDB191FAF9D2821E29F0AA3CEFA03EB6C474B678A3BFB67E699D4BCAA3B3811BF37CCD7A1EF8CC33AF
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......d...hfq.l....Qn.b...hfm.....hf{.....F..`...F..d...F..F...a......hf|......Ll.`...a.o.`...hfi.`...Richa...................PE..L.....Q..........................................@..................................5...............................................................\..................................................................l............................text...@........................... ..`.rdata..T...........................@..@.data........P...X...4..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360wpup.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):179352
                                                                                                                                                                                                      Entropy (8bit):6.124363877722988
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:GFwjHa+W0z9WL2kl8/I3TRGX5FVXh5HnpIx7oY:cwzagIL2kig3UXlnpksY
                                                                                                                                                                                                      MD5:7D5ED86FEFE3D5432EBE6EAE3D7674F0
                                                                                                                                                                                                      SHA1:5B38C793A1289D8387DE9298DE497EFEB9F9F4DF
                                                                                                                                                                                                      SHA-256:AC343E6ACBEC1B5FE008DB55F73D16D39DCF2FA67C68C6E5A6724C3D5ADD46B9
                                                                                                                                                                                                      SHA-512:ECDAB0D673CAE57B66C60AE8A78D5C3227328A4BE3B65573A3201B4FAEFC452A597FB873966A7DC83FAA712F466725DC85DD28103FC3E4423CF77E02412E8700
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K.<....K......K......K......K..q0...K...J...K.......K......K......K.Rich..K.........................PE..L...N..Q.................Z...B......-........p....@.......................................@.....................................x...............................(...@r..................................@............p...............................text....X.......Z.................. ..`.rdata...D...p...F...^..............@..@.data....4..........................@....rsrc...............................@..@.reloc..< ......."...~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):211816
                                                                                                                                                                                                      Entropy (8bit):6.253662936528152
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3072:E7Ym938HMVQi9UnaLsOX1mh4l94Ly8yyuCLjOvPTBfngmH5lvp+FrNo:E7HGsgnRQ1mh4l94LbyujOvPTBZvpoo
                                                                                                                                                                                                      MD5:C24241CA6BA4BF18D56A83CB7476E613
                                                                                                                                                                                                      SHA1:7FBC2945CADA19EE560464ABCDB021BB31ACB677
                                                                                                                                                                                                      SHA-256:ACB59B58BEF4CD704251B6C54D7D41BA0B45F4BF193DAFCAEA753C72572EBD2A
                                                                                                                                                                                                      SHA-512:08FD234338BA1B80FB7899A6B8669B2E7DD84BF6A7FBC24A2583A4F336F86809DB42B4CD5269EED3B9F2B6B8CA1C9F28A405E93D413912661A76AF0B805E81B7
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q...)i..Q...)..7Q...)x..Q.......Q...Q..5Q...)v..Q....h..Q...)m..Q..Rich.Q..................PE..L...o..P..........................................@.......................................@..................................)..x.......8............(..h....p......@...............................h...@............................................text............................... ..`.rdata..............................@..@.data....@...@...$..................@....share...............B..............@....rsrc...8............D..............@..@.reloc...!...p..."..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dll

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):268224
                                                                                                                                                                                                      Entropy (8bit):7.882911756617939
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:6144:bpRkdfPAvEQ5eHe/WcUrKTdu63g8EBVBdfrOTY621ru:s0Ege+CsIig8edfrOeq
                                                                                                                                                                                                      MD5:1334B6FF2C4E06458934213CD7772A62
                                                                                                                                                                                                      SHA1:A35BA3AC230B65058BC3A490F5672ABE877C4E63
                                                                                                                                                                                                      SHA-256:019B78EC242D0D2A70557B78C6A28D4554C0882840494AA60439D8DEBD708CA6
                                                                                                                                                                                                      SHA-512:3B93DE448B3F7231C3B92CA258EAFC4D959FBE5C1A86E9F5DD39E4A07A5DED7593C113C840E637E87CFF538816E32FC5283DB6B0CD23734686D6491F5A634E85
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................P......&/.......................................s...........G..........@................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....G.......H...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360wp\User Data\2019248.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x1024, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):298959
                                                                                                                                                                                                      Entropy (8bit):7.990404767615786
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:xOZMD6KTkMgcRvQN8KKUiTS+3MiTDu5wTEx385uglA6Vk+n3xRv:MMDRHRvQNDKbTX3MiTDuWTLo6A6VhBRv
                                                                                                                                                                                                      MD5:8E5A267C732B09630F7BF0224D5C02C2
                                                                                                                                                                                                      SHA1:0392BECBBD7E79C99BF61986D533DAB35BC40757
                                                                                                                                                                                                      SHA-256:814784BF0A80F0F64A62161AB528E2822BB9263BBE03A001027C5EE3A8D3AAF3
                                                                                                                                                                                                      SHA-512:52D4821E23C82B7EC2C5F5F945848456AA0D51D3EFF02E35C79282C819CA32D63D0607823BA0D7841438CA642B7828E3AF7F6809B6C19E21B756DC2CCAE7A091
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H.....C..............................................!........."$".$.......C............................................................................"................................................................................G.O'Y9f...-.:.e..r..&..N.jq9...Et.g..ii[...q.3Ye..KX.........Q..6.T.1..h.0;.7........I...9..2.*........R...Fce.z....rJ....&Y.&...>.c.:....)B....=s)D...TU.ms..81@.......".....:DE.s.gy7.Z..(5....m5..e.n.T...1..lX..."......ws#...t..pM{..Yd..:u...'.:x'...$8......HKS./."\9..[1....0.'J..[.j..N......b..iUCM8...z.5..=...E.-.P..b.\..x..c..4^....^..,...h.6..i...4[.T.k#..ak..; ....$8..+\9.S-Me..{R)..9.*@....uN...rt..A.q.{.d...eO=<.......s.....W.^.i....jM..Z..8Tu`:e..)....nE.'S=8.v...Z.&j.Lp.....=^..uOG@OG..X'.G^...Jq.....t.#..'.q.T..$..\...R........4..........,.P...cL.c......M0:.v..:.e.6s.L.45..~..tA....Q.d.ms.H..AdH....f.j.......u%.e..Y;u....!...x@b-#.*G..t]L:(+.....{R.k3JT...<+r.u(-2.d}..j^..^.M..3o...c...$

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360wp\User Data\2019248.jpg.cache

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x1024, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):298959
                                                                                                                                                                                                      Entropy (8bit):7.990404767615786
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:xOZMD6KTkMgcRvQN8KKUiTS+3MiTDu5wTEx385uglA6Vk+n3xRv:MMDRHRvQNDKbTX3MiTDuWTLo6A6VhBRv
                                                                                                                                                                                                      MD5:8E5A267C732B09630F7BF0224D5C02C2
                                                                                                                                                                                                      SHA1:0392BECBBD7E79C99BF61986D533DAB35BC40757
                                                                                                                                                                                                      SHA-256:814784BF0A80F0F64A62161AB528E2822BB9263BBE03A001027C5EE3A8D3AAF3
                                                                                                                                                                                                      SHA-512:52D4821E23C82B7EC2C5F5F945848456AA0D51D3EFF02E35C79282C819CA32D63D0607823BA0D7841438CA642B7828E3AF7F6809B6C19E21B756DC2CCAE7A091
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....H.H.....C..............................................!........."$".$.......C............................................................................"................................................................................G.O'Y9f...-.:.e..r..&..N.jq9...Et.g..ii[...q.3Ye..KX.........Q..6.T.1..h.0;.7........I...9..2.*........R...Fce.z....rJ....&Y.&...>.c.:....)B....=s)D...TU.ms..81@.......".....:DE.s.gy7.Z..(5....m5..e.n.T...1..lX..."......ws#...t..pM{..Yd..:u...'.:x'...$8......HKS./."\9..[1....0.'J..[.j..N......b..iUCM8...z.5..=...E.-.P..b.\..x..c..4^....^..,...h.6..i...4[.T.k#..ak..; ....$8..+\9.S-Me..{R)..9.*@....uN...rt..A.q.{.d...eO=<.......s.....W.^.i....jM..Z..8Tu`:e..)....nE.'S=8.v...Z.&j.Lp.....=^..uOG@OG..X'.G^...Jq.....t.#..'.q.T..$..\...R........4..........,.P...cL.c......M0:.v..:.e.6s.L.45..~..tA....Q.d.ms.H..AdH....f.j.......u%.e..Y;u....!...x@b-#.*G..t]L:(+.....{R.k3JT...<+r.u(-2.d}..j^..^.M..3o...c...$

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360wp\User Data\2019255.jpg (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 1280x1024, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):225829
                                                                                                                                                                                                      Entropy (8bit):7.990683218984438
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:29HHQ4zlo5HntLoxhTDtoOuQc9/EQ+V9u:29nQ8o5HtLoxhThruQOEm
                                                                                                                                                                                                      MD5:C80A168A8461484C783E95C2FCD77E70
                                                                                                                                                                                                      SHA1:59167308DA2F3085FEDE5BC8220D7A832F154AFB
                                                                                                                                                                                                      SHA-256:F6C0C6A2A33413D12422748175CCFDE9A14F67C4576F5A04930067484476143A
                                                                                                                                                                                                      SHA-512:207A774FC30BD334575FC90AA7338C8D7CC3409BD90972DBED512A1C4FD208DA109956A301E70E7756B6D24289F82B2C2E0B21847241F4B9F3581A74C6DEEB56
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....,.,.....C..............................................!........."$".$.......C............................................................................"................................................................................P....C...4....*...J..0#A$.Qmf..T"/.G..X..H$U4@.G..G.G................0aC.#A..C.C.a%q.....+.....C.....`....C.........HI!.....I!$...HI!$...HI!$...HI!$...HI!$.b.b...a...&(..$.I.4.[.$.y.VY..i...2.P.41..c,..r.,.8............... ......Y.V._:G..."..qb.(p p..E...................H@.....!.....HI!$.....HI!$...HI!$...HI!$...HI!$...HI!......"....F......E$...n@.aV.T.`..c.8..aR...X$x$x$x$p(....Z...,.<...7.....-N.d...<...1..k...............@...X`..X`..c....s&...a.....!$...$$.VGX.MJ..R..:...=G.......E..I3.$$..BI.$$..BI.$;....IQ..h,h....#.I".ac.c..$..Xv......T...Tk........."........\x'@..k{.W.O....t...O:S..K....>..=|...X........H.@.(bV.E........u+W..5..(...............z.9..B.r..a....2.l\v..9VM.8..NBH.A...HI!$...HI!$...Y!0..V4!.!$RH..#.RH..#

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360wp\User Data\2019255.jpg.cache

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 1280x1024, components 3
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):225829
                                                                                                                                                                                                      Entropy (8bit):7.990683218984438
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:29HHQ4zlo5HntLoxhTDtoOuQc9/EQ+V9u:29nQ8o5HtLoxhThruQOEm
                                                                                                                                                                                                      MD5:C80A168A8461484C783E95C2FCD77E70
                                                                                                                                                                                                      SHA1:59167308DA2F3085FEDE5BC8220D7A832F154AFB
                                                                                                                                                                                                      SHA-256:F6C0C6A2A33413D12422748175CCFDE9A14F67C4576F5A04930067484476143A
                                                                                                                                                                                                      SHA-512:207A774FC30BD334575FC90AA7338C8D7CC3409BD90972DBED512A1C4FD208DA109956A301E70E7756B6D24289F82B2C2E0B21847241F4B9F3581A74C6DEEB56
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:......JFIF.....,.,.....C..............................................!........."$".$.......C............................................................................"................................................................................P....C...4....*...J..0#A$.Qmf..T"/.G..X..H$U4@.G..G.G................0aC.#A..C.C.a%q.....+.....C.....`....C.........HI!.....I!$...HI!$...HI!$...HI!$...HI!$.b.b...a...&(..$.I.4.[.$.y.VY..i...2.P.41..c,..r.,.8............... ......Y.V._:G..."..qb.(p p..E...................H@.....!.....HI!$.....HI!$...HI!$...HI!$...HI!$...HI!......"....F......E$...n@.aV.T.`..c.8..aR...X$x$x$x$p(....Z...,.<...7.....-N.d...<...1..k...............@...X`..X`..c....s&...a.....!$...$$.VGX.MJ..R..:...=G.......E..I3.$$..BI.$$..BI.$;....IQ..h,h....#.I".ac.c..$..Xv......T...Tk........."........\x'@..k{.W.O....t...O:S..K....>..=|...X........H.@.(bV.E........u+W..5..(...............z.9..B.r..a....2.l\v..9VM.8..NBH.A...HI!$...HI!$...Y!0..V4!.!$RH..#.RH..#

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360wp\User Data\gooddownload.json

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                      Entropy (8bit):5.229368986197318
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:qWNuYAwGtdCAwckqquUQbHhy+NuL7RA+l7tkqquUQW:VAwGOAwckUUQbo97RAO7tkUUQW
                                                                                                                                                                                                      MD5:7D15AC56B4661CD00F2769E356CC4654
                                                                                                                                                                                                      SHA1:A9AA21DFDF8C2CD5586AEC6F4032E28DAD1C367D
                                                                                                                                                                                                      SHA-256:197CAB7EBF90FEA8A1FADC5A2A057F86F39FB7D4A98C51A0607038AB508052F5
                                                                                                                                                                                                      SHA-512:580B7FD328FFC1715C51C4736995DE354FEEC1D30B50A2B1D1414BC328927559023DD21EB9DBEEAC921FD5C8FECFB7DF0E96B60B1AA71D08E5088B283060C069
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:[{"url":"http://p8.qhimg.com/bdm/1280_1024_85/t01cedee08e9b9d07f7.jpg","id":2019248,"class_id":"9","url_thumb":"http://p8.qhimg.com/bdr/__85/t01cedee08e9b9d07f7.jpg","playcnt":1,"local":"C:\\Users\\user\\AppData\\Roaming\\360wp\\User Data\\2019248.jpg"},{"url":"http://p1.qhimg.com/bdm/1280_1024_85/t01755cc43f58bff4ee.jpg","id":2019255,"class_id":"26","url_thumb":"http://p1.qhimg.com/bdr/__85/t01755cc43f58bff4ee.jpg","playcnt":1,"local":"C:\\Users\\user\\AppData\\Roaming\\360wp\\User Data\\2019255.jpg"}]

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360wp\User Data\goodwallpaper.json

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):2226
                                                                                                                                                                                                      Entropy (8bit):5.066227342700346
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:48:YVEm0Wi435yRBUCKsxfGBrAOAYAQW535tGdAL+DA+A+AuATyZAl:W0WD35yRBUCKsxfGM535tGq+cym
                                                                                                                                                                                                      MD5:28505EA308010C63A4E8358535EE71A9
                                                                                                                                                                                                      SHA1:31E00543F602E9D044155DC65BE3F0DDDF9C5A86
                                                                                                                                                                                                      SHA-256:7518922A5FB115832F7B7B8F29BB7E83A51882FB4E6443C471647896D175CCF9
                                                                                                                                                                                                      SHA-512:F22ECD1FA80E152DE8E45BA7424333B0D65584D146CC50C1401649F6AB414080FC69388C13F26898491B1B8A3ECA9023136D046A24B87024F9153604776965C9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:{"errno":"0","errmsg":"\u6b63\u5e38","consume":"167","total":"2","data":[{"id":"2019255","class_id":"26","resolution":"3840x2160","url_mobile":"","url":"http:\/\/p1.qhimg.com\/bdr\/__85\/t01755cc43f58bff4ee.jpg","url_thumb":"http:\/\/p1.qhimg.com\/bdr\/__85\/t01755cc43f58bff4ee.jpg","url_mid":"http:\/\/p1.qhimg.com\/bdr\/__85\/t01755cc43f58bff4ee.jpg","download_times":"0","imgcut":"0","tag":"_\u5168\u90e8_ _category_\u4e8c\u6b21\u5143_ _category_\u591c\u666f_ _category_\u8857\u5934_ _category_\u52a8\u6f2b\u5361\u901a_","create_time":"2020-05-27 16:20:19","update_time":"2020-05-27 17:06:53","rdata":[],"img_1600_900":"http:\/\/p1.qhimg.com\/bdm\/1600_900_85\/t01755cc43f58bff4ee.jpg","img_1440_900":"http:\/\/p1.qhimg.com\/bdm\/1440_900_85\/t01755cc43f58bff4ee.jpg","img_1366_768":"http:\/\/p1.qhimg.com\/bdm\/1366_768_85\/t01755cc43f58bff4ee.jpg","img_1280_800":"http:\/\/p1.qhimg.com\/bdm\/1280_800_85\/t01755cc43f58bff4ee.jpg","img_1280_1024":"http:\/\/p1.qhimg.com\/bdm\/1280_1024_85\/t0

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\360????.lnk

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu May 23 07:36:12 2013, mtime=Thu Dec 28 22:21:28 2023, atime=Thu May 23 07:36:12 2013, length=3760960, window=hideshowminimized
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1316
                                                                                                                                                                                                      Entropy (8bit):4.6503713910851925
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24:8mCovEYdOE3ClOld5Tm8TbyA+qERdBdldBmUUxhgOqygm:8mCoMYdOUCId5yuRJodBdpYiLyg
                                                                                                                                                                                                      MD5:A78D6DC904B8606FCD40624404701B37
                                                                                                                                                                                                      SHA1:B1E6E6B5A4C276A2AB182494D03A547CF09C6C9D
                                                                                                                                                                                                      SHA-256:EDE1CF27E006E61DF712EA2F6B4650FDA5B46B7714BF5365F62FD199FC231BA1
                                                                                                                                                                                                      SHA-512:4B487E112135121E700AEF07CF9E0CB5CE223135E72CB30D4530E72D99750FE0010AE3444D6A2F7361F8F8065F733EE35B09B060047DCBA283736B7BF635D7E6
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:L..................F.... ...h..W.......9..h..W..@c9.....................#....P.O. .:i.....+00.../C:\.....................1......W....PROGRA~2.........O.I.W......................V.......+.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W....360.8......W...W..............................+.3.6.0.....^.1......W....360DES~1..F......W...W......;.....................y...3.6.0.D.e.s.k.t.o.p.....J.1......W....Bin.8......W...W.......S......................i.B.i.n.....j.2.@c9..B.D .360DES~1.EXE..N......B.D.W.......V.....................G..3.6.0.D.e.s.k.t.o.p...e.x.e.......g...............-.......f...........i.......C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe..J.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.........*................@Z|...K.J...

                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                      General

                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Entropy (8bit):7.992113234589977
                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                      File name:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      File size:22'004'296 bytes
                                                                                                                                                                                                      MD5:aae3eedbdc1b1a99f7c2844f85352692
                                                                                                                                                                                                      SHA1:8025c689f73816e6c275e38002649d91244d6db2
                                                                                                                                                                                                      SHA256:2c1d65f58f07ad391492f0c0b1c335321f7b0d6e9f41218e04404e7b58692ddb
                                                                                                                                                                                                      SHA512:85572587d270bd81180ef6f71bd7ea67ef68e043d2938cf44821efa8f448141f821219fc5f9eef5896c92098e0cb1c49c2a094cf52dae5dc9bfdca0b69f67766
                                                                                                                                                                                                      SSDEEP:393216:MM29LTLRF5Aqahe8A6+M5JnOHz15dDaYqZJRPcVxkbnpIwpmXhd99lEuts:Mn9LBF5AiDzM5OzndDfwJRPUepfmxbot
                                                                                                                                                                                                      TLSH:E9273322BBCAC0BAEBD2233545A99B1F6975F6324B505DCBB3E50B5C4E216C06D36313
                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7I.OV'.OV'.OV'.....KV'.F...SV'.Q...JV'.F....V'.F...\V'.h.J.KV'.h.\.hV'.OV&..W'.F....V'.Q...NV'.F...NV'.RichOV'................

                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                      Icon Hash:3b317131256b652f

                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Entrypoint:0x469a9a
                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                      Digitally signed:true
                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                      Time Stamp:0x51947733 [Thu May 16 06:05:39 2013 UTC]
                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                      OS Version Major:5
                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                      File Version Major:5
                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                      Subsystem Version Major:5
                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                      Import Hash:404cf80e26b57b92c5197972a37704a5

                                                                                                                                                                                                      Authenticode Signature

                                                                                                                                                                                                      Signature Valid:true
                                                                                                                                                                                                      Signature Issuer:CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
                                                                                                                                                                                                      Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                      Error Number:0
                                                                                                                                                                                                      Not Before, Not After
                                                                                                                                                                                                      • 11/03/2013 01:00:00 11/03/2016 00:59:59
                                                                                                                                                                                                      Subject Chain
                                                                                                                                                                                                      • CN=Qihoo 360 Software (Beijing) Company Limited, OU=Tech. Dev. Dept., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Qihoo 360 Software (Beijing) Company Limited, L=Beijing, S=Beijing, C=CN
                                                                                                                                                                                                      Version:3
                                                                                                                                                                                                      Thumbprint MD5:3CA61B8826F65521BFB360E9053FC4F7
                                                                                                                                                                                                      Thumbprint SHA-1:1E5BB77FCB63F26277F95AAE09B852699327A08A
                                                                                                                                                                                                      Thumbprint SHA-256:BF14AC18F94AB836E88591B971FA00AC7A690A22E1354016059FBC12351558C8
                                                                                                                                                                                                      Serial:51BD5D8E45B82A0210F17FE4C5233468

                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                      call 00007FCA7CDF7726h
                                                                                                                                                                                                      jmp 00007FCA7CDEAC4Eh
                                                                                                                                                                                                      mov edi, edi
                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                      cmp dword ptr [ebp+10h], 00000000h
                                                                                                                                                                                                      jne 00007FCA7CDEADD6h
                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                      pop ebp
                                                                                                                                                                                                      ret
                                                                                                                                                                                                      mov edx, dword ptr [ebp+0Ch]
                                                                                                                                                                                                      mov ecx, dword ptr [ebp+08h]
                                                                                                                                                                                                      dec dword ptr [ebp+10h]
                                                                                                                                                                                                      je 00007FCA7CDEADE5h
                                                                                                                                                                                                      movzx eax, word ptr [ecx]
                                                                                                                                                                                                      test ax, ax
                                                                                                                                                                                                      je 00007FCA7CDEADDDh
                                                                                                                                                                                                      cmp ax, word ptr [edx]
                                                                                                                                                                                                      jne 00007FCA7CDEADD8h
                                                                                                                                                                                                      inc ecx
                                                                                                                                                                                                      inc ecx
                                                                                                                                                                                                      inc edx
                                                                                                                                                                                                      inc edx
                                                                                                                                                                                                      jmp 00007FCA7CDEADBAh
                                                                                                                                                                                                      movzx eax, word ptr [ecx]
                                                                                                                                                                                                      movzx ecx, word ptr [edx]
                                                                                                                                                                                                      sub eax, ecx
                                                                                                                                                                                                      pop ebp
                                                                                                                                                                                                      ret
                                                                                                                                                                                                      mov edi, edi
                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                      sub esp, 0Ch
                                                                                                                                                                                                      mov eax, dword ptr [004A9118h]
                                                                                                                                                                                                      xor eax, ebp
                                                                                                                                                                                                      mov dword ptr [ebp-04h], eax
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      xor esi, esi
                                                                                                                                                                                                      push edi
                                                                                                                                                                                                      cmp ebx, esi
                                                                                                                                                                                                      jne 00007FCA7CDEADF0h
                                                                                                                                                                                                      call 00007FCA7CDEDCCAh
                                                                                                                                                                                                      push 00000016h
                                                                                                                                                                                                      pop edi
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      mov dword ptr [eax], edi
                                                                                                                                                                                                      call 00007FCA7CDE8004h
                                                                                                                                                                                                      add esp, 14h
                                                                                                                                                                                                      mov eax, edi
                                                                                                                                                                                                      jmp 00007FCA7CDEAF1Ch
                                                                                                                                                                                                      push dword ptr [ebp+08h]
                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                      call 00007FCA7CDEAFE0h
                                                                                                                                                                                                      pop ecx
                                                                                                                                                                                                      pop ecx
                                                                                                                                                                                                      cmp eax, dword ptr [ebp+08h]
                                                                                                                                                                                                      jc 00007FCA7CDEADD9h
                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                      mov word ptr [ebx], ax
                                                                                                                                                                                                      jmp 00007FCA7CDEAD9Dh
                                                                                                                                                                                                      mov edx, dword ptr [ebp+0Ch]
                                                                                                                                                                                                      mov eax, dword ptr [edx]
                                                                                                                                                                                                      mov ecx, dword ptr [eax+14h]
                                                                                                                                                                                                      cmp ecx, esi
                                                                                                                                                                                                      jne 00007FCA7CDEADFCh
                                                                                                                                                                                                      mov eax, ebx
                                                                                                                                                                                                      cmp word ptr [ebx], si
                                                                                                                                                                                                      je 00007FCA7CDEADEEh
                                                                                                                                                                                                      movzx ecx, word ptr [eax]
                                                                                                                                                                                                      cmp cx, 0041h
                                                                                                                                                                                                      jc 00007FCA7CDEADDEh
                                                                                                                                                                                                      cmp cx, 005Ah
                                                                                                                                                                                                      jnbe 00007FCA7CDEADD8h
                                                                                                                                                                                                      add ecx, 20h
                                                                                                                                                                                                      mov word ptr [eax], cx
                                                                                                                                                                                                      inc eax
                                                                                                                                                                                                      inc eax
                                                                                                                                                                                                      cmp word ptr [eax], si
                                                                                                                                                                                                      jne 00007FCA7CDEADB6h
                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                      jmp 00007FCA7CDEAECFh
                                                                                                                                                                                                      push dword ptr [eax+00h]

                                                                                                                                                                                                      Rich Headers

                                                                                                                                                                                                      Programming Language:
                                                                                                                                                                                                      • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                                                      • [C++] VS2008 build 21022
                                                                                                                                                                                                      • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                                                      • [ C ] VS2005 build 50727
                                                                                                                                                                                                      • [IMP] VS2005 build 50727
                                                                                                                                                                                                      • [C++] VS2008 SP1 build 30729
                                                                                                                                                                                                      • [RES] VS2008 build 21022
                                                                                                                                                                                                      • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xa3e900x190.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xae0000xec0a0.rsrc
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x14fa7980x1ab0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x19b0000x7444.reloc
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x8b6f00x1c.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x982700x40.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x8b0000x618.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                      Sections

                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                      .text0x10000x8912c0x89200False0.5042445305378305data6.57735167781926IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .rdata0x8b0000x1b0820x1b200False0.3235527073732719data4.5992220814652605IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .data0xa70000x69b80x3e00False0.248046875data4.123195216012852IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                      .rsrc0xae0000xec0a00xec200False0.9657505211090525data7.960227616232132IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .reloc0x19b0000xa2b60xa400False0.5201505335365854data5.496479285816793IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                      Resources

                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                      DLL0xaebb00x5ff017-zip archive data, version 0.4ChineseChina1.0002468438343755
                                                                                                                                                                                                      DLL0x10eab40x341b3Microsoft Cabinet archive data, Windows 2000/XP setup, 213427 bytes, 1 file, at 0x2c +A "7z.dll", number 1, 12 datablocks, 0x1 compressionChineseChina1.0003373518814396
                                                                                                                                                                                                      LICENCE0x142c680x1ad8Unicode text, UTF-16, little-endian text, with CRLF line terminatorsChineseChina0.539871944121071
                                                                                                                                                                                                      OEMDATA0x1447400x567-zip archive data, version 0.3ChineseChina0.9069767441860465
                                                                                                                                                                                                      SETUPCONFIG0x1447980x2f0a7-zip archive data, version 0.4ChineseChina1.000913469523335
                                                                                                                                                                                                      SETUPDATA0x1476a40x18dataChineseChina1.3333333333333333
                                                                                                                                                                                                      SETUPPLUGIN0x1476bc0x10dataChineseChina0.6875
                                                                                                                                                                                                      SKIN0x1476cc0x254df7-zip archive data, version 0.4ChineseChina1.0003664945451214
                                                                                                                                                                                                      RT_ICON0x16cbac0xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsChineseChina0.582089552238806
                                                                                                                                                                                                      RT_ICON0x16da540x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsChineseChina0.730595667870036
                                                                                                                                                                                                      RT_ICON0x16e2fc0x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsChineseChina0.5541907514450867
                                                                                                                                                                                                      RT_ICON0x16e8640xfda7PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedChineseChina0.9992145992145992
                                                                                                                                                                                                      RT_ICON0x17e60c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600ChineseChina0.5579875518672199
                                                                                                                                                                                                      RT_ICON0x180bb40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224ChineseChina0.5956848030018762
                                                                                                                                                                                                      RT_ICON0x181c5c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088ChineseChina0.7384751773049646
                                                                                                                                                                                                      RT_ICON0x1820c40x10a77PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedChineseChina0.9740966063182585
                                                                                                                                                                                                      RT_ICON0x192b3c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600ChineseChina0.4276970954356846
                                                                                                                                                                                                      RT_ICON0x1950e40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224ChineseChina0.4896810506566604
                                                                                                                                                                                                      RT_ICON0x19618c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088ChineseChina0.40691489361702127
                                                                                                                                                                                                      RT_DIALOG0x1965f40x2cdataChineseChina0.8409090909090909
                                                                                                                                                                                                      RT_DIALOG0x1966200x350dataChineseChina0.5176886792452831
                                                                                                                                                                                                      RT_DIALOG0x1969700xdcdataChineseChina0.7227272727272728
                                                                                                                                                                                                      RT_DIALOG0x196a4c0x1dadataChineseChina0.5780590717299579
                                                                                                                                                                                                      RT_DIALOG0x196c280x1acdataChineseChina0.5677570093457944
                                                                                                                                                                                                      RT_DIALOG0x196dd40xdedataChineseChina0.7117117117117117
                                                                                                                                                                                                      RT_DIALOG0x196eb40x1cedataChineseChina0.5735930735930735
                                                                                                                                                                                                      RT_DIALOG0x1970840x412dataChineseChina0.5239923224568138
                                                                                                                                                                                                      RT_DIALOG0x1974980x6cdataChineseChina0.75
                                                                                                                                                                                                      RT_DIALOG0x1975040x152dataChineseChina0.4940828402366864
                                                                                                                                                                                                      RT_STRING0x1976580x2d8dataChineseChina0.49175824175824173
                                                                                                                                                                                                      RT_STRING0x1979300x49adataChineseChina0.6239388794567062
                                                                                                                                                                                                      RT_STRING0x197dcc0x5a4dataChineseChina0.5706371191135734
                                                                                                                                                                                                      RT_STRING0x1983700x1aadataChineseChina0.755868544600939
                                                                                                                                                                                                      RT_STRING0x19851c0x1d4dataChineseChina0.7243589743589743
                                                                                                                                                                                                      RT_STRING0x1986f00x49cdataChineseChina0.4872881355932203
                                                                                                                                                                                                      RT_STRING0x198b8c0x294dataChineseChina0.7090909090909091
                                                                                                                                                                                                      RT_STRING0x198e200x19adataChineseChina0.8512195121951219
                                                                                                                                                                                                      RT_STRING0x198fbc0x17edataChineseChina0.6387434554973822
                                                                                                                                                                                                      RT_STRING0x19913c0x86dataChineseChina0.7985074626865671
                                                                                                                                                                                                      RT_STRING0x1991c40xf4dataChineseChina0.6844262295081968
                                                                                                                                                                                                      RT_STRING0x1992b80x68AmigaOS bitmap font "egSb \220\250`\352\201\361]\204v3", 60255 elementsChineseChina0.8076923076923077
                                                                                                                                                                                                      RT_STRING0x1993200x24dataChineseChina0.4444444444444444
                                                                                                                                                                                                      RT_STRING0x1993440x56dataChineseChina0.6627906976744186
                                                                                                                                                                                                      RT_STRING0x19939c0x2cdataChineseChina0.5454545454545454
                                                                                                                                                                                                      RT_STRING0x1993c80x128dataChineseChina0.597972972972973
                                                                                                                                                                                                      RT_STRING0x1994f00x22dataChineseChina0.38235294117647056
                                                                                                                                                                                                      RT_ACCELERATOR0x1995140x70dataChineseChina0.6785714285714286
                                                                                                                                                                                                      RT_RCDATA0x1995840x80OpenPGP Public KeyEnglishUnited States1.0859375
                                                                                                                                                                                                      RT_GROUP_ICON0x1996040x68dataChineseChina0.6923076923076923
                                                                                                                                                                                                      RT_GROUP_ICON0x19966c0x3eTarga image data - Map 32 x 2679 x 1 +1ChineseChina0.8548387096774194
                                                                                                                                                                                                      RT_VERSION0x1996ac0x5acdataChineseChina0.3409090909090909
                                                                                                                                                                                                      RT_MANIFEST0x199c580x448ASCII text, with very long lines (612), with CRLF line terminatorsEnglishUnited States0.47354014598540145

                                                                                                                                                                                                      Imports

                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                      KERNEL32.dllFindFirstFileW, FormatMessageW, CopyFileW, GetVolumeInformationW, OpenProcess, CompareFileTime, SetThreadPriority, GetCurrentThread, SetPriorityClass, GetEnvironmentVariableW, GetSystemInfo, InitializeCriticalSection, DeleteCriticalSection, GetLongPathNameW, lstrcmpiW, CreateMutexW, MultiByteToWideChar, SizeofResource, LoadResource, FindResourceW, LoadLibraryExW, GetCommandLineW, QueryDosDeviceW, GetLogicalDriveStringsW, GetSystemDirectoryW, CreateProcessW, FindAtomW, GlobalAddAtomW, GetTickCount, QueryPerformanceCounter, QueryPerformanceFrequency, CreateFileA, GetTempPathA, GlobalUnlock, GlobalLock, GlobalAlloc, GetPrivateProfileStringW, CreateThread, TerminateProcess, FindResourceExW, GetDiskFreeSpaceExW, LockResource, GetFileTime, ReadProcessMemory, GetFileSizeEx, GetFullPathNameW, GetPrivateProfileIntW, FindClose, FindNextFileW, lstrcpyW, CreateToolhelp32Snapshot, LocalAlloc, LocalFree, GetTempFileNameW, GetFileAttributesW, LoadLibraryW, GetCurrentProcessId, CreateFileW, DeviceIoControl, GlobalFindAtomW, GetVersionExW, CreateDirectoryW, lstrcmpiA, Process32FirstW, WriteConsoleW, GetConsoleOutputCP, WritePrivateProfileStringW, GetDriveTypeA, GetCurrentDirectoryA, FlushFileBuffers, SetStdHandle, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetStringTypeW, GetStringTypeA, GetLocaleInfoA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetConsoleMode, GetConsoleCP, GetModuleHandleA, GetStartupInfoA, SetHandleCount, IsValidCodePage, GetOEMCP, GetModuleFileNameA, HeapCreate, GetCPInfo, LCMapStringW, LCMapStringA, GetStartupInfoW, ExitProcess, ExitThread, RtlUnwind, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, SystemTimeToFileTime, LocalFileTimeToFileTime, InitializeCriticalSectionAndSpinCount, GetACP, SetEnvironmentVariableW, TlsFree, TlsAlloc, Process32NextW, WriteFile, GetDriveTypeW, SetLastError, GetCurrentThreadId, GetCurrentProcess, FlushInstructionCache, LeaveCriticalSection, lstrcatW, Sleep, GetLocalTime, GetModuleFileNameW, GetShortPathNameW, MoveFileW, MoveFileExW, DeleteFileW, GetProcAddress, FreeLibrary, SetFileAttributesW, RemoveDirectoryW, GetTempPathW, lstrlenA, OutputDebugStringW, DebugBreak, InterlockedIncrement, lstrlenW, InterlockedDecrement, WaitForSingleObject, CloseHandle, EnterCriticalSection, MulDiv, RaiseException, GetModuleHandleW, CreateEventW, SetEvent, GetLocaleInfoW, GetLastError, ResetEvent, LockFile, GetFileSize, OpenThread, TlsSetValue, TlsGetValue, ReleaseMutex, SetFilePointerEx, GetFileType, lstrcmpA, GetSystemTime, ReadFile, UnlockFile, CreateFileMappingW, GetSystemTimeAsFileTime, HeapSize, HeapReAlloc, HeapDestroy, VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, LoadLibraryA, HeapAlloc, GetProcessHeap, HeapFree, InterlockedCompareExchange, GetStdHandle, SetEndOfFile, SetFileTime, GetFileAttributesExW, UnmapViewOfFile, SetFilePointer, WriteConsoleA, WideCharToMultiByte, MapViewOfFile, GetExitCodeProcess
                                                                                                                                                                                                      USER32.dllIsWindow, SendMessageW, CharNextW, CharUpperW, LoadStringW, PostMessageW, FindWindowW, SendMessageTimeoutW, wvsprintfW, EnableWindow, GetDlgItem, IsWindowEnabled, ShowWindow, SetDlgItemTextW, IsWindowVisible, EndDialog, GetWindowLongW, SetWindowTextW, EnumWindows, GetClassNameW, GetWindowThreadProcessId, EmptyClipboard, SetClipboardData, CloseClipboard, SetCursor, PtInRect, OpenClipboard, MessageBoxW, wsprintfW, WaitForInputIdle, DialogBoxParamW, OffsetRect, PeekMessageW, GetMessageW, TranslateMessage, DispatchMessageW, BringWindowToTop, RegisterClassExW, LoadCursorW, GetClassInfoExW, GetSystemMetrics, LoadImageW, IsIconic, PostQuitMessage, InflateRect, IsDialogMessageW, GetSystemMenu, EnableMenuItem, GetActiveWindow, CharLowerW, EndPaint, BeginPaint, CallWindowProcW, DefWindowProcW, CopyRect, KillTimer, SetTimer, CreateDialogParamW, GetWindowTextLengthW, MessageBeep, SetFocus, RedrawWindow, InvalidateRect, DestroyWindow, CreateWindowExW, FindWindowExW, GetWindowTextW, ReleaseDC, GetDC, SetWindowLongW, GetParent, GetWindow, GetWindowRect, ExitWindowsEx, UnregisterClassA, MonitorFromWindow, GetMonitorInfoW, MapWindowPoints, SetWindowPos, ScreenToClient, GetClientRect, MoveWindow
                                                                                                                                                                                                      GDI32.dllCreateCompatibleDC, DeleteDC, CreateCompatibleBitmap, DeleteObject, BitBlt, SetViewportOrgEx, SelectObject
                                                                                                                                                                                                      ADVAPI32.dllLookupAccountSidW, RegQueryInfoKeyW, RegDeleteValueW, RegDeleteKeyW, RegOpenKeyExW, RegCreateKeyExW, RegSetValueExW, GetUserNameW, GetNamedSecurityInfoW, BuildExplicitAccessWithNameW, SetEntriesInAclW, SetNamedSecurityInfoW, GetExplicitEntriesFromAclW, EqualSid, GetTrusteeNameW, DeleteAce, RegOpenKeyExA, LookupAccountNameW, RegOpenKeyW, RegEnumKeyExW, RegCloseKey, RegEnumKeyExA, RegQueryValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegQueryValueExA
                                                                                                                                                                                                      SHELL32.dllShellExecuteW, ShellExecuteExW, SHCreateDirectoryExW, SHChangeNotify, SHGetSpecialFolderPathW, SHGetSpecialFolderLocation, SHGetMalloc, SHGetFolderPathW, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW
                                                                                                                                                                                                      ole32.dllOleRun, CoInitialize, CoUninitialize, CoCreateGuid, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance, CoTaskMemRealloc
                                                                                                                                                                                                      OLEAUT32.dllVariantClear, SysAllocStringByteLen, SysStringByteLen, VarUI4FromStr, VariantInit, SysStringLen, SysFreeString, SysAllocString
                                                                                                                                                                                                      SHLWAPI.dllSHGetValueA, PathFileExistsW, SHGetValueW, PathCombineW, PathFindFileNameW, SHDeleteValueW, SHDeleteKeyW, PathIsRelativeW, PathAppendW, PathAddBackslashW, PathRemoveFileSpecW, PathIsPrefixW, wnsprintfW, PathRemoveBackslashW, PathAppendA, SHSetValueA, PathFindExtensionW, StrCmpIW, PathIsDirectoryW, PathIsURLW, PathIsNetworkPathW, StrRetToStrW, PathMatchSpecW, PathRemoveExtensionW, SHSetValueW
                                                                                                                                                                                                      COMCTL32.dllInitCommonControlsEx
                                                                                                                                                                                                      MSIMG32.dllAlphaBlend
                                                                                                                                                                                                      VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                                                                                                                                                                                      PSAPI.DLLGetProcessImageFileNameW, EnumProcesses, GetModuleFileNameExW
                                                                                                                                                                                                      urlmon.dllURLDownloadToFileW, URLDownloadToCacheFileW
                                                                                                                                                                                                      IPHLPAPI.DLLGetAdaptersInfo
                                                                                                                                                                                                      WININET.dllInternetGetConnectedState
                                                                                                                                                                                                      NETAPI32.dllNetbios
                                                                                                                                                                                                      SETUPAPI.dllSetupIterateCabinetW
                                                                                                                                                                                                      CRYPT32.dllCryptMsgClose, CertCloseStore, CryptMsgUpdate, CryptMsgOpenToDecode, CertOpenStore, CertGetNameStringW, CertGetCertificateContextProperty
                                                                                                                                                                                                      WINTRUST.dllWTHelperGetProvSignerFromChain, WTHelperProvDataFromStateData

                                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                      ChineseChina
                                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.905795097 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.223809004 CET8049710171.13.14.66192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.223941088 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.224361897 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.542486906 CET8049710171.13.14.66192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.542596102 CET8049710171.13.14.66192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.542671919 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.599854946 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.918622971 CET8049710171.13.14.66192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.918725967 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.660742998 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.980195045 CET8049710171.13.14.66192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.980261087 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:19.553544044 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:20.133143902 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:20.726906061 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:21.914402008 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:24.273761034 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:25.924263954 CET4972080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:26.633532047 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:26.930027008 CET4972080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:28.930252075 CET4972080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:29.133315086 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:32.945636034 CET4972080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:33.836289883 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:40.945657969 CET4972080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:43.242794037 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.624476910 CET4972180192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.927664995 CET8049721101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.931849003 CET4972180192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:45.046379089 CET4972180192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:45.348969936 CET8049721101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:45.348995924 CET8049721101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:45.349009991 CET8049721101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:45.349065065 CET4972180192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:46.611888885 CET4972180192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:46.913552999 CET8049721101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.012139082 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.322374105 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.322520971 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.357517958 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.542227030 CET4972380192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.668148994 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.668170929 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.668380976 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.706908941 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.863482952 CET8049723101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.863624096 CET4972380192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.867671013 CET4972380192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.017307043 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.017421961 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.018445969 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.188772917 CET8049723101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.189614058 CET8049723101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.189668894 CET8049723101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.189805984 CET4972380192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.211525917 CET4972380192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.328993082 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.329149961 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.330001116 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.532763004 CET8049723101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.640286922 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.640357018 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.647659063 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.957901955 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.957979918 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.959037066 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:49.269392014 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:49.269619942 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.104095936 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.269526005 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.269932985 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.270241976 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.294198036 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.414388895 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.539422989 CET4972280192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.580271006 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.580296040 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.609030008 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.609112024 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.645899057 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.851625919 CET8049722171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.962305069 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.962344885 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.962415934 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:01.345964909 CET4973180192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:01.672971964 CET80497311.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:01.673136950 CET4973180192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.039510012 CET4971080192.168.2.8171.13.14.66
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.092678070 CET4973280192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.115994930 CET4973380192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.116108894 CET4973180192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.214004040 CET8049732138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.214087963 CET4973280192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.214373112 CET4973280192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.236983061 CET8049733138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.237129927 CET4973380192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.237658024 CET4973380192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.335941076 CET8049732138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.338560104 CET8049732138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.357323885 CET4973280192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.358892918 CET8049733138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.442246914 CET80497311.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.478936911 CET8049732138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.479007959 CET4973280192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510531902 CET8049733138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510551929 CET8049733138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510565042 CET8049733138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510577917 CET8049733138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510626078 CET4973380192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.513206005 CET4973380192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.634171963 CET8049733138.113.29.74192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.634258986 CET4973380192.168.2.8138.113.29.74
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.179965019 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.308182001 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.308269978 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.308600903 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.436414003 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.314291954 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.629359007 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.629493952 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249387980 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249455929 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249550104 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249633074 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249676943 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249712944 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249749899 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249767065 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249797106 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249804974 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249840975 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249880075 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249888897 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249918938 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.250097990 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.251718044 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.251771927 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.251833916 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.255225897 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.255264997 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.255333900 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.273072958 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.273092985 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.273145914 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.274782896 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.274841070 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.274889946 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.278497934 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.278536081 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.278604984 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.282043934 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.282061100 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.282119036 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.285584927 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.285599947 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.285675049 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.289263964 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.367588997 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.376422882 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.376483917 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.376636982 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.378474951 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.378566027 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.378762007 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.381932974 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.381978989 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.382052898 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.385417938 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.385457993 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.385524035 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.389241934 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.389285088 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.389460087 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.392544985 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.392585039 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.392788887 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.396087885 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.396130085 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.396368980 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.399701118 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.399740934 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.399846077 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.403333902 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.403522015 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.403616905 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.406913996 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.406930923 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.406985998 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.410501003 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.410521984 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.410571098 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.414079905 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.414096117 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.414143085 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.417743921 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.417762041 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.417818069 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.421511889 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.421526909 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.421581030 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.424953938 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.424969912 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.425030947 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.428464890 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.428481102 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.428534985 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.432518005 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.432533979 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.432591915 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.435599089 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.435612917 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.435657978 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.439203978 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.439218998 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.439263105 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.442852020 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.442873955 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.442924976 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.446391106 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.446407080 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.446456909 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.450016975 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.450031996 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.450088024 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.453567028 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.453582048 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.453635931 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.457159042 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.457173109 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.457226038 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.494508982 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.494524956 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.494581938 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.503006935 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.503021002 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.503073931 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.504852057 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.504865885 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.504921913 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.508384943 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.508399010 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.508451939 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.511964083 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.511976957 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.512027979 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.515039921 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.515053988 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.515105009 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.518378973 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.518392086 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.518445969 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.521686077 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.521711111 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.521755934 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.525028944 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.525043964 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.525114059 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.528665066 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.528678894 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.528742075 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.531781912 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.532021999 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.532133102 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.535128117 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.535142899 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.535196066 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.538566113 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.538579941 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.538623095 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.541774035 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.541788101 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.541837931 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.544992924 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.545006990 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.545058966 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.548243999 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.548259020 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.548307896 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.551482916 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.551497936 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.551544905 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.554761887 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.554775000 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.554822922 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.558032036 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.558044910 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.558092117 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.561295033 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.561307907 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.561356068 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.564321995 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.564336061 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.564383030 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.567373037 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.567387104 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.567442894 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.570259094 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.570296049 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.570478916 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.573103905 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.573117018 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.573163033 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.575922012 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.575937033 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.575987101 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.578645945 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.578660011 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.578716040 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.581152916 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.581166983 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.581234932 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.583822966 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.583842993 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.583915949 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.586394072 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.586575985 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.586636066 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.588840008 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.589039087 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.589083910 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.591603994 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.591618061 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.591669083 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.593837976 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.593851089 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.593894005 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.596232891 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.596419096 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.596468925 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.598925114 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.598937988 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.598980904 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.601152897 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.601171970 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.601222992 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.603533983 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.603548050 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.603600979 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.606048107 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.606061935 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.606113911 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.608437061 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.608450890 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.608494997 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.610961914 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.610975981 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.611176014 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.613315105 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.613327980 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.613370895 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.615819931 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.615833044 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.615869999 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.618238926 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.618350983 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.618443966 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.620888948 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.620909929 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.620960951 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.623177052 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.623193026 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.623236895 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.625720024 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.625734091 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.625776052 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.628092051 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.628109932 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.628150940 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.630774975 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.630789042 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.630834103 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.633308887 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.633322954 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.633369923 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.635451078 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.635468960 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.635518074 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.637258053 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.637270927 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.637315989 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.638879061 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.638992071 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.639069080 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.640650034 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.640662909 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.640723944 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.642411947 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.718878031 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.845643997 CET804973418.160.172.19192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.845736980 CET4973480192.168.2.818.160.172.19
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.229321957 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.367913961 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.368874073 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.372796059 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.511333942 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948395967 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948421001 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948437929 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948451996 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948470116 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948482037 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948489904 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948498964 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948512077 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948528051 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948544979 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948545933 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948589087 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948589087 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.952131987 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.952152967 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.952264071 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.956075907 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.956091881 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.956157923 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.959925890 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.007427931 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.007445097 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.007492065 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.008469105 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.008486986 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.008541107 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.012414932 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.012433052 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.012480021 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.016274929 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.016298056 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.016349077 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.020253897 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.020268917 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.020312071 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.088752031 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.088776112 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.088812113 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.090663910 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.090678930 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.090739012 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.094520092 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.094571114 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.094624043 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.098429918 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.098454952 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.098496914 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.102392912 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.102415085 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.102462053 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.106298923 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.106318951 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.106376886 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.110260963 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.110285044 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.110342026 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.114052057 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.114083052 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.114124060 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.118012905 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.118032932 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.118084908 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.121994019 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.122014999 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.122157097 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.125876904 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.125900030 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.125972986 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.129710913 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.129734039 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.129806995 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.133589983 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.133606911 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.133660078 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.147449017 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.147471905 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.147557974 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.149377108 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.149399042 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.149462938 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.153225899 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.153248072 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.153301954 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.157171965 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.157195091 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.157228947 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.161027908 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.161067963 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.161083937 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.164961100 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.164979935 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.165047884 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.168864965 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.168884039 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.168956041 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.172789097 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.172815084 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.172833920 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.176680088 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.176696062 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.176740885 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.180649996 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.180682898 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.180716038 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.229255915 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.229286909 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.229326963 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.231127977 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.231146097 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.231226921 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.235032082 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.235047102 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.235086918 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.238992929 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.239011049 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.239075899 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.242813110 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.242837906 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.242878914 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.246797085 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.246814013 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.246872902 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.250655890 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.250669956 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.250709057 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.254586935 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.254605055 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.254652023 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.258492947 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.258508921 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.258543968 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.262434959 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.262454987 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.262485981 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.266325951 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.266344070 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.266376019 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.270162106 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.270201921 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.270204067 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.274039030 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.274053097 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.274092913 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.277664900 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.277688980 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.277745962 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.281128883 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.281142950 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.281205893 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.284506083 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.284521103 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.284576893 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.287815094 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.287827969 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.287869930 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.291218996 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.291246891 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.291280985 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.294558048 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.294584036 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.294653893 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.297230005 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.297247887 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.297297955 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.299789906 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.299806118 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.299853086 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.302335978 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.302355051 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.302412033 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.304928064 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.304940939 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.304996967 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.307423115 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.307435989 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.307486057 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.309961081 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.309977055 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.310026884 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.312465906 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.312483072 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.312550068 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.315054893 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.315068960 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.315107107 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.317579031 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.317594051 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.317657948 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.320089102 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.320122004 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.320141077 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.322647095 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.322711945 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.322743893 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.325258970 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.325282097 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.325314045 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.327635050 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.327660084 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.327699900 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.330048084 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.330074072 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.330111980 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.332490921 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.332506895 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.332568884 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.334903002 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.334917068 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.334945917 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.337372065 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.337387085 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.337451935 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.339848042 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.339864016 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.339900017 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.342214108 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.342235088 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.342284918 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.344630003 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.344666004 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.344696045 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.347086906 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.347121954 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.347151995 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.349525928 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.349550009 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.349582911 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.352036953 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.352054119 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.352111101 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.354423046 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.354453087 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.354477882 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.356828928 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.356873989 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.356874943 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.359318972 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.359333992 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.359376907 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.361783028 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.361797094 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.361845016 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.368782997 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.368799925 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.368908882 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.369769096 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.369781971 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.369839907 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.371929884 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.371943951 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.371993065 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.374015093 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.374027967 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.374075890 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.376070023 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.376089096 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.376132965 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.378156900 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.378171921 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.378199100 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.380198002 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.380212069 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.380287886 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.382232904 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.382251024 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.382288933 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.384263039 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.384277105 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.384325981 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.386346102 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.386372089 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.386390924 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.388348103 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.388360023 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.388390064 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.390377045 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.390389919 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.390434027 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.392446995 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.392461061 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.392528057 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.394485950 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.394525051 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.394581079 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.396529913 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.396543026 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.396600962 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.398550987 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.398566008 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.398598909 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.400634050 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.400646925 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.400707960 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.402637959 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.402656078 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.402687073 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.404658079 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.404690027 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.404726028 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.406661987 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.406702042 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.406748056 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.408739090 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.408751965 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.408807039 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.410741091 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.410756111 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.410794973 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.412823915 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.412839890 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.412898064 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.414869070 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.414891005 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.414942980 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.416914940 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.416932106 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.416985989 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.418916941 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.418934107 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.418971062 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.420928001 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.420943022 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.420970917 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.423015118 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.423027992 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.423067093 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.425066948 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.425082922 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.425129890 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.427056074 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.427083969 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.427134037 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.429081917 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.429101944 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.429128885 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.431123972 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.431163073 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.431175947 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.433207989 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.433228970 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.433547974 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.435214043 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.435244083 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.435271025 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.437239885 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.437289953 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.437294006 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.439204931 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.439217091 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.439301014 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.496815920 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.637402058 CET804973518.161.170.106192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:11.638992071 CET4973580192.168.2.818.161.170.106
                                                                                                                                                                                                      Dec 29, 2023 00:21:12.826333046 CET4973680192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:13.174906969 CET80497361.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:13.175033092 CET4973680192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:13.175393105 CET4973680192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:13.528817892 CET80497361.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:14.629472017 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:14.946264029 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:14.946408987 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:17.456804037 CET80497311.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:17.457505941 CET4973180192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:17.783535004 CET80497311.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:17.783627033 CET4973180192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.036797047 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.351685047 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.351804972 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:25.534214973 CET80497361.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:25.555766106 CET4973680192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:25.901314974 CET80497361.192.137.108192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:25.901437998 CET4973680192.168.2.81.192.137.108
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.056819916 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.371623993 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.371776104 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.205403090 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.206644058 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.520505905 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.520598888 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.521137953 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.522488117 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.522716999 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.523093939 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.834167004 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.834193945 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.834325075 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.834882975 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.849622965 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.849693060 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.148144960 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.148226976 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.439212084 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.716162920 CET4976580192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.752511978 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.752604961 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.893788099 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.019949913 CET8049765101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.020072937 CET4976580192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.027446985 CET4976580192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.206840992 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.206922054 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.332102060 CET8049765101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.348258018 CET8049765101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.348275900 CET8049765101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.348328114 CET4976580192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.371592999 CET4976580192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.675260067 CET8049765101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:39.730957985 CET4976880192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:39.808753967 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.034842968 CET8049768101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.034930944 CET4976880192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.043870926 CET4976880192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.121747017 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.121834040 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.347595930 CET8049768101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.356060982 CET8049768101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.356082916 CET8049768101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.356137037 CET4976880192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.387141943 CET4976880192.168.2.8101.198.2.147
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.690922976 CET8049768101.198.2.147192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:44.838723898 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:44.838804007 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.362438917 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.676083088 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.676183939 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:47.496737957 CET4973080192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:47.811646938 CET8049730171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.358885050 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.672358990 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.672954082 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:22:01.863946915 CET4976480192.168.2.8171.8.167.89
                                                                                                                                                                                                      Dec 29, 2023 00:22:02.177149057 CET8049764171.8.167.89192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:22:02.177218914 CET4976480192.168.2.8171.8.167.89

                                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.537019968 CET5821353192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.896249056 CET53582131.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.602859974 CET5848753192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.933532000 CET53584871.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.661696911 CET4938853192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.965959072 CET53493881.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:19.555391073 CET5830253192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:20.106847048 CET53583021.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:25.925373077 CET6062053192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:26.097635031 CET53606201.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:32.743307114 CET6005253192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:32.939935923 CET53600521.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:38.965389967 CET6022653192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:39.449395895 CET53602261.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:40.972238064 CET6375653192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:41.275552034 CET53637561.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.296148062 CET5628553192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.418893099 CET53562851.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:46.780684948 CET5334553192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:46.941236019 CET53533451.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:50.656985998 CET6195053192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:50.995877028 CET53619501.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.104631901 CET6288353192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.264755964 CET53628831.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:00.128458023 CET5550553192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:00.435400009 CET53555051.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:01.347132921 CET6266353192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.353069067 CET6266353192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.358078003 CET53626631.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.409930944 CET5097453192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.474678993 CET53626631.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.938143969 CET53509741.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.013504982 CET6064253192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.178896904 CET53606421.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.313731909 CET6481053192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.667758942 CET53648101.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.898104906 CET5238753192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.228272915 CET53523871.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:12.739259958 CET5754153192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:14.630287886 CET5595253192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:15.110070944 CET53559521.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.038351059 CET5192053192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.348001003 CET53519201.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.054044962 CET5248753192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.214174032 CET53524871.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:33.024691105 CET6180253192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:33.185267925 CET53618021.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.440159082 CET5687753192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.799705029 CET53568771.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.790195942 CET5921453192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.989273071 CET53592141.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.362169027 CET5314753192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.650255919 CET53531471.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.359186888 CET5685753192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.690109015 CET53568571.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:22:01.865330935 CET6141153192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:22:01.987535000 CET53614111.1.1.1192.168.2.8
                                                                                                                                                                                                      Dec 29, 2023 00:22:04.094885111 CET6131653192.168.2.81.1.1.1
                                                                                                                                                                                                      Dec 29, 2023 00:22:04.218981028 CET53613161.1.1.1192.168.2.8

                                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.537019968 CET192.168.2.81.1.1.10x9c9cStandard query (0)s.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.602859974 CET192.168.2.81.1.1.10xe25bStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.661696911 CET192.168.2.81.1.1.10xb907Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:19.555391073 CET192.168.2.81.1.1.10xfaeeStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:25.925373077 CET192.168.2.81.1.1.10x96dStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:32.743307114 CET192.168.2.81.1.1.10x1188Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:38.965389967 CET192.168.2.81.1.1.10xdf50Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:40.972238064 CET192.168.2.81.1.1.10xb02fStandard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.296148062 CET192.168.2.81.1.1.10x4804Standard query (0)s.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:46.780684948 CET192.168.2.81.1.1.10xdb30Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:50.656985998 CET192.168.2.81.1.1.10xbcb5Standard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.104631901 CET192.168.2.81.1.1.10xa415Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:00.128458023 CET192.168.2.81.1.1.10xf1b3Standard query (0)res.qhupdate.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:01.347132921 CET192.168.2.81.1.1.10xd8c6Standard query (0)static.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.353069067 CET192.168.2.81.1.1.10xd8c6Standard query (0)static.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.409930944 CET192.168.2.81.1.1.10x2cf4Standard query (0)wallpaper.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.013504982 CET192.168.2.81.1.1.10xbf49Standard query (0)p1.qhimg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.313731909 CET192.168.2.81.1.1.10x79b6Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.898104906 CET192.168.2.81.1.1.10x72b9Standard query (0)p8.qhimg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:12.739259958 CET192.168.2.81.1.1.10x132dStandard query (0)api.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:14.630287886 CET192.168.2.81.1.1.10x5d57Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.038351059 CET192.168.2.81.1.1.10x8d11Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.054044962 CET192.168.2.81.1.1.10x332aStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:33.024691105 CET192.168.2.81.1.1.10x7c3Standard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.440159082 CET192.168.2.81.1.1.10xab51Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.790195942 CET192.168.2.81.1.1.10x12baStandard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.362169027 CET192.168.2.81.1.1.10x55bfStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.359186888 CET192.168.2.81.1.1.10xe6ccStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:22:01.865330935 CET192.168.2.81.1.1.10x11f6Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:22:04.094885111 CET192.168.2.81.1.1.10x524eStandard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false

                                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.896249056 CET1.1.1.1192.168.2.80x9c9cNo error (0)s.360.cn171.13.14.66A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.896249056 CET1.1.1.1192.168.2.80x9c9cNo error (0)s.360.cn171.8.167.89A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.896249056 CET1.1.1.1192.168.2.80x9c9cNo error (0)s.360.cn101.198.2.147A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:19:57.896249056 CET1.1.1.1192.168.2.80x9c9cNo error (0)s.360.cn180.163.251.231A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.933532000 CET1.1.1.1192.168.2.80xe25bName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.965959072 CET1.1.1.1192.168.2.80xb907Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:20.106847048 CET1.1.1.1192.168.2.80xfaeeName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:26.097635031 CET1.1.1.1192.168.2.80x96dName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:32.939935923 CET1.1.1.1192.168.2.80x1188Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:39.449395895 CET1.1.1.1192.168.2.80xdf50Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:41.275552034 CET1.1.1.1192.168.2.80xb02fName error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.418893099 CET1.1.1.1192.168.2.80x4804No error (0)s.360.cn101.198.2.147A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.418893099 CET1.1.1.1192.168.2.80x4804No error (0)s.360.cn171.8.167.89A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.418893099 CET1.1.1.1192.168.2.80x4804No error (0)s.360.cn171.13.14.66A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:44.418893099 CET1.1.1.1192.168.2.80x4804No error (0)s.360.cn180.163.251.231A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:46.941236019 CET1.1.1.1192.168.2.80xdb30Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:50.995877028 CET1.1.1.1192.168.2.80xbcb5Name error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.264755964 CET1.1.1.1192.168.2.80xa415Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:00.435400009 CET1.1.1.1192.168.2.80xf1b3No error (0)res.qhupdate.com1.192.137.108A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:00.435400009 CET1.1.1.1192.168.2.80xf1b3No error (0)res.qhupdate.com36.110.213.38A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:00.435400009 CET1.1.1.1192.168.2.80xf1b3No error (0)res.qhupdate.com180.163.237.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.358078003 CET1.1.1.1192.168.2.80xd8c6No error (0)static.apc.360.cnstatic.apc.360.cn.lxdns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.358078003 CET1.1.1.1192.168.2.80xd8c6No error (0)static.apc.360.cn.lxdns.com138.113.29.74A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.474678993 CET1.1.1.1192.168.2.80xd8c6No error (0)static.apc.360.cnstatic.apc.360.cn.lxdns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.474678993 CET1.1.1.1192.168.2.80xd8c6No error (0)static.apc.360.cn.lxdns.com138.113.29.74A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.938143969 CET1.1.1.1192.168.2.80x2cf4No error (0)wallpaper.apc.360.cnwallpaper.apc.360.cn.wscdns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:02.938143969 CET1.1.1.1192.168.2.80x2cf4No error (0)wallpaper.apc.360.cn.wscdns.com138.113.29.74A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.178896904 CET1.1.1.1192.168.2.80xbf49No error (0)p1.qhimg.comd2aydouiit1aqm.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.178896904 CET1.1.1.1192.168.2.80xbf49No error (0)d2aydouiit1aqm.cloudfront.net18.160.172.19A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.178896904 CET1.1.1.1192.168.2.80xbf49No error (0)d2aydouiit1aqm.cloudfront.net18.160.172.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.178896904 CET1.1.1.1192.168.2.80xbf49No error (0)d2aydouiit1aqm.cloudfront.net18.160.172.38A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.178896904 CET1.1.1.1192.168.2.80xbf49No error (0)d2aydouiit1aqm.cloudfront.net18.160.172.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.667758942 CET1.1.1.1192.168.2.80x79b6Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.228272915 CET1.1.1.1192.168.2.80x72b9No error (0)p8.qhimg.comd2aydouiit1aqm.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.228272915 CET1.1.1.1192.168.2.80x72b9No error (0)d2aydouiit1aqm.cloudfront.net18.161.170.106A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.228272915 CET1.1.1.1192.168.2.80x72b9No error (0)d2aydouiit1aqm.cloudfront.net18.161.170.58A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.228272915 CET1.1.1.1192.168.2.80x72b9No error (0)d2aydouiit1aqm.cloudfront.net18.161.170.60A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.228272915 CET1.1.1.1192.168.2.80x72b9No error (0)d2aydouiit1aqm.cloudfront.net18.161.170.128A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:12.861079931 CET1.1.1.1192.168.2.80x132dNo error (0)api.msn.comapi-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:15.110070944 CET1.1.1.1192.168.2.80x5d57Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.348001003 CET1.1.1.1192.168.2.80x8d11Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.214174032 CET1.1.1.1192.168.2.80x332aName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:33.185267925 CET1.1.1.1192.168.2.80x7c3Name error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.799705029 CET1.1.1.1192.168.2.80xab51Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.989273071 CET1.1.1.1192.168.2.80x12baName error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.650255919 CET1.1.1.1192.168.2.80x55bfName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.690109015 CET1.1.1.1192.168.2.80xe6ccName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:22:01.987535000 CET1.1.1.1192.168.2.80x11f6Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Dec 29, 2023 00:22:04.218981028 CET1.1.1.1192.168.2.80x524eName error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                                                                      • s.360.cn
                                                                                                                                                                                                      • res.qhupdate.com
                                                                                                                                                                                                      • static.apc.360.cn
                                                                                                                                                                                                      • wallpaper.apc.360.cn
                                                                                                                                                                                                      • p1.qhimg.com
                                                                                                                                                                                                      • p8.qhimg.com

                                                                                                                                                                                                      HTTP Packets

                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      0192.168.2.849710171.13.14.66806116C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.224361897 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=10047 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:19:58.542596102 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:19:58 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Wed, 24 Apr 2019 08:04:53 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5cc018a5-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.599854946 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=2179 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:04.918622971 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:04 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Wed, 24 Apr 2019 08:04:53 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5cc018a5-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.660742998 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=28509 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:12.980195045 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:12 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Wed, 24 Apr 2019 08:04:53 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5cc018a5-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:19.553544044 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:20.133143902 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:20.726906061 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:21.914402008 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:24.273761034 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:26.633532047 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:29.133315086 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:33.836289883 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:43.242794037 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18192 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      1192.168.2.849721101.198.2.147806724C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:20:45.046379089 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Dec 29, 2023 00:20:45.348995924 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:45 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:33 GMT
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      ETag: "6295d265-0"
                                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      2192.168.2.849722171.8.167.89806116C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.357517958 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=6291 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.668170929 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:47 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.706908941 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=28540 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.017307043 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:47 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.018445969 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16080 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.328993082 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:48 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.330001116 CET390OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=24600&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.640286922 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:48 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.647659063 CET380OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=43609&r2=8823 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.957901955 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:48 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.959037066 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=9946 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:49.269392014 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:49 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.104095936 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.539422989 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      3192.168.2.849723101.198.2.147806724C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:20:47.867671013 CET180OUTGET /bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Dec 29, 2023 00:20:48.189614058 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:48 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:21 GMT
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      ETag: "6295d259-0"
                                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      4192.168.2.849730171.8.167.89806116C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.645899057 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=16313 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:20:59.962344885 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:20:59 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.314291954 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=10437 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:07.629359007 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:07 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:14.629472017 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=1547 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:14.946264029 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:14 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.036797047 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32263 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:24.351685047 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:24 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.056819916 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=22406 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:31.371623993 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:31 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.206644058 CET952OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.522488117 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:34 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.523093939 CET864OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.849622965 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:34 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      5192.168.2.8497311.192.137.108804656C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.116108894 CET346OUTGET /wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa&w=6.2&t=6658734&active=1 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Language: zh-CN
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
                                                                                                                                                                                                      Host: res.qhupdate.com
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:17.456804037 CET290INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:17 GMT
                                                                                                                                                                                                      Content-Type: text/plain
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      Keep-Alive: timeout=20
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      X-Powered-By: PHP/5.3.10
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                      Data Ascii: 140


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      6192.168.2.849732138.113.29.74804656C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.214373112 CET216OUTGET /cms/guajian.html HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Language: zh-CN
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
                                                                                                                                                                                                      Host: static.apc.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.338560104 CET544INHTTP/1.1 200 OK
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:05 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 21
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      Expires: Thu, 28 Dec 2023 14:12:01 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Last-Modified: Tue, 19 May 2020 09:34:07 GMT
                                                                                                                                                                                                      ETag: "1-5a5fcfb2905a3"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Cache-Control: max-age=600
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Age: 33544
                                                                                                                                                                                                      X-Cache: HIT from cache.51cdn.com
                                                                                                                                                                                                      X-Via: 1.1 PSrbJP1ty77:3 (Cdn Cache Server V2.0), 1.1 PS-DFW-04Eay52:9 (Cdn Cache Server V2.0)
                                                                                                                                                                                                      X-Ws-Request-Id: 658e02e1_PS-DFW-04xVs53_13627-23937
                                                                                                                                                                                                      Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 04 00 b7 ef dc 83 01 00 00 00
                                                                                                                                                                                                      Data Ascii: 3


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      7192.168.2.849733138.113.29.74804656C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.237658024 CET260OUTGET /index.php?c=WallPaper&a=getAppsByDigest&start=0&count=100 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Language: zh-CN
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
                                                                                                                                                                                                      Host: wallpaper.apc.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510531902 CET417INHTTP/1.1 200 OK
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:05 GMT
                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      Expires: Thu, 28 Dec 2023 23:26:06 GMT
                                                                                                                                                                                                      Server: nginx/1.16.1
                                                                                                                                                                                                      Cache-Control: max-age=600
                                                                                                                                                                                                      X-Cache: MISS from cache.51cdn.com
                                                                                                                                                                                                      X-Via: 1.1 PSrbJP1qr80:4 (Cdn Cache Server V2.0), 1.1 PS-DFW-04Eay52:14 (Cdn Cache Server V2.0)
                                                                                                                                                                                                      X-Ws-Request-Id: 658e02e1_PS-DFW-04Eay52_10633-14853
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510551929 CET1286INData Raw: 38 62 32 0d 0a 7b 22 65 72 72 6e 6f 22 3a 22 30 22 2c 22 65 72 72 6d 73 67 22 3a 22 5c 75 36 62 36 33 5c 75 35 65 33 38 22 2c 22 63 6f 6e 73 75 6d 65 22 3a 22 31 36 37 22 2c 22 74 6f 74 61 6c 22 3a 22 32 22 2c 22 64 61 74 61 22 3a 5b 7b 22 69 64
                                                                                                                                                                                                      Data Ascii: 8b2{"errno":"0","errmsg":"\u6b63\u5e38","consume":"167","total":"2","data":[{"id":"2019255","class_id":"26","resolution":"3840x2160","url_mobile":"","url":"http:\/\/p1.qhimg.com\/bdr\/__85\/t01755cc43f58bff4ee.jpg","url_thumb":"http:\/\/p1.q
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510565042 CET947INData Raw: 64 72 5c 2f 5f 5f 38 35 5c 2f 74 30 31 63 65 64 65 65 30 38 65 39 62 39 64 30 37 66 37 2e 6a 70 67 22 2c 22 75 72 6c 5f 6d 69 64 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 70 38 2e 71 68 69 6d 67 2e 63 6f 6d 5c 2f 62 64 72 5c 2f 5f 5f 38 35 5c 2f 74 30
                                                                                                                                                                                                      Data Ascii: dr\/__85\/t01cedee08e9b9d07f7.jpg","url_mid":"http:\/\/p8.qhimg.com\/bdr\/__85\/t01cedee08e9b9d07f7.jpg","download_times":"0","imgcut":"0","tag":"_\u5168\u90e8_ _category_\u5e73\u539f_ _category_\u65f7\u91ce_ _category_\u98ce\u666f\u5927\u72
                                                                                                                                                                                                      Dec 29, 2023 00:21:05.510577917 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      8192.168.2.84973418.160.172.19804656C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:06.308600903 CET235OUTGET /bdm/1280_1024_85/t01755cc43f58bff4ee.jpg HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Language: zh-CN
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
                                                                                                                                                                                                      Host: p1.qhimg.com
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249387980 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                      Content-Type: image/jpeg
                                                                                                                                                                                                      Content-Length: 225829
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:09 GMT
                                                                                                                                                                                                      Last-Modified: Wed, 05 Jul 2023 13:10:38 GMT
                                                                                                                                                                                                      xzp: zhlbmrwuizeiralelsmlml
                                                                                                                                                                                                      Expires: Wed, 27 Mar 2024 23:21:09 GMT
                                                                                                                                                                                                      Cache-Control: s-maxage=7776000, max-age=7776000
                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                      Timing-Allow-Origin: *
                                                                                                                                                                                                      XCS: HIT
                                                                                                                                                                                                      KCS-Via: MISS from w-fc01.lato;MISS from w-sc01.bjyt
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      X-Cache: Miss from cloudfront
                                                                                                                                                                                                      Via: 1.1 0878f88c5343da8d67032ec6de2d7e04.cloudfront.net (CloudFront)
                                                                                                                                                                                                      X-Amz-Cf-Pop: IAH50-P2
                                                                                                                                                                                                      X-Amz-Cf-Id: ioH7nDlJJb70_EgkYRtkOl-ECjM8fsMAmkcggXBpzil15VXEXNBWsQ==
                                                                                                                                                                                                      Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c2 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 00 03 04 05 06 07 08 ff c4 00 1a 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 f1 50 cd f3 10 c2 43 01 09 16 34 85 84 8b 1a 2a 96 82 92 4a e5 80 04 30 23 41 24 03 51 6d 66 88 a4 54 22 2f 8a 47 10 15 58 90 b6 48 24 55 34 40 e2 47 82 c6 82 47 82 47 94 91 a0 a1 e0 a1 e0 81 e0 91 a0 91 c1 9a fc fa db ae 30 61 43 c1 23 41 03 81 43 81 43 81 61 25 71 c0 81 c0 b0 c0 2b a8 a1 c0 b0 80 43 05 0c 01 08 00 60 02 08 b0 81 43 08 81 81 01 94 01 80 92 12 48 49 21 01 01 04 02 10 49 21 24 84 92 12 48 49 21 24 84 92 12 48 49 21 24 84 92 12 48 49 21 24 84 92 12 48 49 21 24 87 62 13 62 c6 80 8d 00 61 85 8d 05 26 28 8d 05 24 8a 49 16 34 02 5b 04 24 c6 79 aa 56 59 a4 c6 69 a1 cc 86 f7 32 cd 50 ce 34 31 90 e8 63 2c d7 0c 72 d4 2c b0 38 b1 a0 b1 a0 a1 e0 a1 e0 91 c0 a1 e0 85 a0 81 e5 20 b0 09 1e 1c dd 98 fa 59 f4 56 1a 5f 3a 47 14 82 c0 22 15 9b 71 62 dc 28 70 20 70 05 b1 45 0c 05 0e 00 ae a2 86 00 0c 05 0e a0 86 0a 18 0b 08 01 84 48 40 90 ac b1 d5 d1 21 15 01 80 06 02 48 49 21 24 84 0c a4 92 02 48 49 21 24 84 92 12 48 49 21 24 84 92 12 48 49 21 24 84 92 12 48 49 21 24 84 92 12 48 49 21 db 84 d8 b1 a0 09 80 8d 22 06 8a a4 c0 46 82 96 82 96 82 92 45 24 8b 18 c5 6e 40 09 61 56 d8 54 eb 60 b1 e0 ab 63 14 38 04 09 61 52 d8 07 b0 58 24 78 24 78 24 78 24 70 28 b0 09 1a 08 5a 08 1e 08 2c 02 3c d8 bc
                                                                                                                                                                                                      Data Ascii: JFIF,,C!"$"$C"PC4*J0#A$QmfT"/GXH$U4@GGG0aC#ACCa%q+C`CHI!I!$HI!$HI!$HI!$HI!$bba&($I4[$yVYi2P41c,r,8 YV_:G"qb(p pEH@!HI!$HI!$HI!$HI!$HI!$HI!"FE$n@aVT`c8aRX$x$x$x$p(Z,<
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249455929 CET1286INData Raw: 8e bf 37 d0 f2 f5 f9 bb 2d 4e 9e 64 8e 2e 10 3c ac f7 8b 31 de 95 b0 6b 82 07 14 81 c0 a1 a0 81 c0 81 c0 b0 92 b0 e0 40 ea 00 c0 58 60 a1 d4 58 60 b0 81 63 02 90 c3 1a 73 26 f2 03 01 61 04 06 00 18 09 21 24 81 10 8b 24 24 8e 56 47 58 e5 4d 4a b9
                                                                                                                                                                                                      Data Ascii: 7-Nd.<1k@X`X`cs&a!$$$VGXMJR:=GEI3$$BI$$BI$;IQh,h#I"acc$XvTTk"\x'@k{WOtO:SK>=|XH@(bVE
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249633074 CET1286INData Raw: 6e c3 17 58 96 fa 3c 55 8b 06 b9 d6 b6 02 b1 62 95 87 05 61 d4 45 b1 44 57 05 61 d4 40 e2 ab 57 10 a9 62 d5 61 d4 50 e8 45 60 55 21 cd 81 86 a2 82 00 0c 14 10 40 60 a0 c2 2b a0 24 81 56 06 a1 0e 74 99 fa 55 b7 6e fe 4d da d6 ae 76 fc 73 09 d1 be
                                                                                                                                                                                                      Data Ascii: nX<UbaEDWa@WbaPE`U!@`+$VtUnMvshfWi>~.o/+7Spn];8mHz]Ck6dmW:3Zu5e-}^g=4"T#chZ73gf*Vw+jl,`mv-oklwt+
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249676943 CET1286INData Raw: 13 ea c9 90 fb a4 65 b3 c7 44 27 e5 ee 07 00 25 49 e7 c7 63 1d b7 79 2e df 9a e9 cb d1 78 1f a5 79 2d 4e 27 42 8c 9d 65 bb 05 dc 49 d9 e2 77 21 df 19 ad da fc ef 41 76 f3 f1 b2 66 c1 d3 e6 cd d4 0a e3 d3 64 a0 90 b6 94 c9 d0 d3 bb 3a e4 71 fb 3c
                                                                                                                                                                                                      Data Ascii: eD'%Icy.xy-N'BeIw!Avfd:q<nq=]VtgtC=7^l:w6s^alRu+[]EVKmbjHPj 0PA( S Pj%y?AUowz'>Lk^O_~m{Fa<
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249712944 CET1286INData Raw: cf 66 79 75 70 b2 45 fa 6b d5 6e 74 e4 35 9d 2d 6b f4 7a c7 ba bf 2f 2f 5f c6 fd 11 a3 e6 37 e7 4d c6 eb f2 3e 83 37 c9 e5 7d 0b ce 27 8d 86 7a 31 66 8e 87 b8 cd f9 b5 3f 4f f9 ce 2f 8e e3 f5 3d 7e 3b 79 55 eb fb 94 f9 47 23 b5 cd c7 5f 55 e7 fa
                                                                                                                                                                                                      Data Ascii: fyupEknt5-kz//_7M>7}'z1f?O/=~;yUG#_Uy0is::M?<r{'oZ]VtHC7^GL^Gcey-Cq5XS5F]4S|sQM0%j:|?;z~}<:gmU)c
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249749899 CET1286INData Raw: 46 56 a2 59 a6 87 c8 d5 35 cb 65 89 3a 66 eb 69 d9 a8 e3 35 26 c9 8e c1 a6 6c b8 d7 b2 d5 d0 f4 38 df 92 f4 f8 28 d0 f8 cf 74 9d f9 7c ff 00 bd e9 3b 1e 7b c4 df d6 ab 59 c1 5e ca ae 6b f3 fd ae 5e ae 4b aa af 9e fb b4 f3 29 e9 93 9b 66 3e 5a 4b
                                                                                                                                                                                                      Data Ascii: FVY5e:fi5&l8(t|;{Y^k^K)f>ZKc9jjWkS_^7:N}>*ueV&r'g6esj]o7s"U9~>_|{S__dDZ!dHb(A$>Z=sO>'
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249797106 CET1286INData Raw: 82 af 31 eb 3c de a7 91 16 57 a9 5e bc 4a 69 c4 e0 a0 e4 dd 2f a6 ea 49 bc c9 20 9e 7f a3 cb 89 5b 59 1c dc ce cb ea b4 72 fb 36 0c 1a 35 ce be 7b cf fd 27 ca 39 f6 3d 57 84 b7 53 8d ec 7c f6 6e 5d fe 95 b7 cd e3 c6 b4 78 ae 67 4f af 2c 74 75 f1
                                                                                                                                                                                                      Data Ascii: 1<W^Ji/I [Yr65{'9=WS|n]xgO,tu*{Tqtu4}O[qv~Kts.\9huVydFOs'~\}g>vRA6:Nk^|;p\*jP^KN&2HMzTg3ciE
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249840975 CET1286INData Raw: 9e da 6b c8 b3 5b 73 d2 db c1 eb eb 3e 6b 93 ee 3c 76 75 99 d2 d2 dd 16 ed 97 01 17 4d 62 1d 49 66 6d d9 74 ef 17 69 cf b2 06 2f 71 e1 63 67 b1 f2 9b 65 f4 d4 f3 3a 7e 5f 40 42 be bf 3c d4 bc 49 aa f9 7d 3e 0e b3 4d 71 91 3a 1d 6e e6 75 9b a1 cf
                                                                                                                                                                                                      Data Ascii: k[s>k<vuMbIfmti/qcge:~_@B<I}>Mq:nuT\[wK=J<]|}|MuyC+9F35#X5'g4-*Vf&MVUj6Mgu'2t0V0$e0d`]U(V[R|Z{eTSY54BIgY"Y.
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249880075 CET1286INData Raw: 7b 3e 39 8e fc 23 59 dd 8f b1 c3 34 f4 f9 3a 0a 86 9c 27 68 73 af 2e e8 e0 6b 38 54 fa 3f 37 9d 5b 65 72 ac a6 c0 82 23 da 4a 94 71 25 ab ee 3c 3f 73 17 d7 46 ab 97 a5 e3 d5 2c 86 b9 75 53 d6 e1 67 b6 65 b6 9e fe 1d 32 b6 e5 e8 2b 14 20 05 8a 50
                                                                                                                                                                                                      Data Ascii: {>9#Y4:'hs.k8T?7[er#Jq%<?sF,uSge2+ PdSks$/^VviM)<tsqjqu]<>cU;_I?3xoWnp&,tdY$FS<.,."Y=u[_|7ijn3e23ao.(NW]"
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.249918938 CET468INData Raw: 2d af 59 c5 4d 94 59 42 e9 ac aa 58 6a 97 67 4a 85 f2 5a 4d c4 a2 bd a0 ca bb 8a e2 1b e2 73 9b a2 65 e6 0e ac 5e 5c ea 14 e5 ce b1 97 90 fd 46 35 ab 0d e4 19 20 b2 da a9 2e be 31 97 82 13 28 db 53 cd 25 b4 e9 66 b5 b2 b8 6a 2e 6a f2 af db e4 eb
                                                                                                                                                                                                      Data Ascii: -YMYBXjgJZMse^\F5 .1(S%fj.j3}+vl04rBXZnJC*9oUe{hM4S^PF]N5Z_7Y7TvT[F{YH [[S^u]TJ[ e"HA-E)h
                                                                                                                                                                                                      Dec 29, 2023 00:21:09.251718044 CET1286INData Raw: 03 09 40 30 58 41 04 01 82 51 b2 97 90 40 a3 5d 9d ab a3 4d 29 2c 54 14 f2 b3 0e f5 31 b3 b7 e7 3a a5 7c be 9e 15 cd 2e 05 52 e3 19 c6 95 29 96 1a a8 5b 5d cc 80 a0 92 04 10 19 21 20 8a 60 84 92 11 94 a7 7b 36 84 f5 71 4d 52 fa 6e a5 5e 87 34 59
                                                                                                                                                                                                      Data Ascii: @0XAQ@]M),T1:|.R)[]! `{6qMRn^4Y|8=6N9t0v*[\fV*(zOuSd]Wh$BHMKuh`ZXR$s^[{\FBIXT^9u/*3A#.[


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      9192.168.2.84973518.161.170.106804656C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.372796059 CET235OUTGET /bdm/1280_1024_85/t01cedee08e9b9d07f7.jpg HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Language: zh-CN
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
                                                                                                                                                                                                      Host: p8.qhimg.com
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948395967 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                      Content-Type: image/jpeg
                                                                                                                                                                                                      Content-Length: 298959
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:10 GMT
                                                                                                                                                                                                      Last-Modified: Wed, 02 Aug 2023 04:10:28 GMT
                                                                                                                                                                                                      xzp: zhlbmrwuizeiralelsmlml
                                                                                                                                                                                                      Expires: Wed, 27 Mar 2024 23:21:10 GMT
                                                                                                                                                                                                      Cache-Control: s-maxage=7776000, max-age=7776000
                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                      Timing-Allow-Origin: *
                                                                                                                                                                                                      XCS: HIT
                                                                                                                                                                                                      KCS-Via: MISS from w-fc01.lato;MISS from w-sc09.zzzc
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      X-Cache: Miss from cloudfront
                                                                                                                                                                                                      Via: 1.1 82888bfcd462dda403ae64a071327a74.cloudfront.net (CloudFront)
                                                                                                                                                                                                      X-Amz-Cf-Pop: DFW57-P3
                                                                                                                                                                                                      X-Amz-Cf-Id: v4_7yBymcxYwfPSXan3rKPfqqTWKjJReo4gXVFBapFxYr13fxOlTPQ==
                                                                                                                                                                                                      Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c2 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 ff c4 00 1a 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 d7 9e ef 47 cc bc 4f 27 59 39 66 82 d7 1f 2d 83 3a 8b 65 aa 1d 72 e9 90 b8 ca 26 8d 09 4e ae 6a 71 39 a1 96 ec 45 74 cc 67 a0 aa 69 69 5b 96 c1 11 71 a7 33 59 65 a7 a2 4b 58 ac c6 89 dd b8 8b 1d c2 a8 9e 91 d1 51 c4 b0 af 36 c6 bf 54 e8 31 9f 19 68 ea 30 3b 92 37 9d b7 17 e7 e9 a5 9d d1 ce eb 49 bf cd d2 39 90 c5 32 1a 2a c0 80 a3 ed e3 e2 0e c0 52 06 d9 d9 46 63 65 b2 7a 89 bb 8d ec 72 4a f0 f4 e9 a8 ba ba 26 59 c8 26 b9 ec b7 86 f7 3e ce 63 95 3a 96 18 c9 d8 29 42 f4 a6 01 91 3d 73 29 44 e0 cb c2 ae 54 55 a5 6d 73 ea 82 fd 38 31 40 c8 13 a2 01 81 8e 81 22 a8 f7 c6 c3 98 d3 3a 44 45 c7 73 0d 67 79 37 d1 5a 92 d4 28 35 c7 a7 a6 a7 a6 6d 35 16 e9 9b 97 65 9e 6e 84 54 d4 cd d7 31 cc db 6c 58 a0 e6 2e 22 d5 a9 ac f4 d2 8e 98 17 77 73 23 ba 1c f7 74 04 f4 70 4d 7b 83 ad 59 64 cf 11 3a 75 a1 15 e9 86 ba 27 82 3a 78 27 bb 83 a6 24 38 83 94 cb 14 d5 cf 48 4b 53 2e 2f 88 22 5c 39 c1 be 5b 31 a3 98 ce 1b 30 9c 27 4a 8c 80 5b e3 a2 95 6a 89 81 4e 99 da 96 86 ac c2 97 9a 62 80 08 69 55 43 4d 38 e5 13 c3 7a 08 35 e9 e6 3d 95 b3 0a 45 ed 2d a6 50 d3 c7 62 a7 5c b1 19 78 8e ae 63 14 11 34 5e 19 11 c6 ad 15 5e 05 02 2c 09 81 f3 68 09 36 15 a4 69 91 df ca 34 5b 84 54 d9 6b 23 ea b0 1d 61 6b 95 ec 3b 20 86 0d
                                                                                                                                                                                                      Data Ascii: JFIFHHC!"$"$C"GO'Y9f-:er&Njq9Etgii[q3YeKXQ6T1h0;7I92*RFcezrJ&Y&>c:)B=s)DTUms81@":DEsgy7Z(5m5enT1lX."ws#tpM{Yd:u':x'$8HKS./"\9[10'J[jNbiUCM8z5=E-Pb\xc4^^,h6i4[Tk#ak;
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948421001 CET1286INData Raw: f3 d1 8b 24 38 b6 e1 2b 5c 39 c5 53 2d 4d 65 cc 1d 7b 52 29 8a de 39 fa 2a 40 8a a6 ed e7 75 4e cb 19 0f 72 74 d5 06 41 b6 71 d1 7b 86 64 a3 e7 dd 65 4f 3d 3c f5 9b 02 90 08 0b f4 73 e8 02 f5 e7 e8 57 ab 5e ae 69 af 15 cd 0b 6a 4d 86 dd 5a 83 19
                                                                                                                                                                                                      Data Ascii: $8+\9S-Me{R)9*@uNrtAq{deO=<sW^ijMZ8Tu`:e)nE'S=8vZ&jLp=^uOG@OGX'G^Jqt#'qT$\R4,PcLcM0:v:e6sL45.~tAQdms
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948437929 CET1286INData Raw: ee e0 ee ee 17 77 73 3b bb 82 d6 1f 22 7b ba 97 4c 70 74 4c 25 dd dc c9 e8 e4 5b ab c1 7e af 0e dd 5e 09 ee e6 fb bb 85 d3 12 9f 77 70 fa 26 05 dd dc ce ee 81 4f 57 82 d1 1c 2e e8 91 31 1d d1 a4 77 73 3a 3b 83 a2 78 2b dd c1 dd dc ce ee e6 a3 a7
                                                                                                                                                                                                      Data Ascii: ws;"{LptL%[~^wp&OW.1ws:;x+0wpwwwpwZ>18rR&Z/'fV-V-kt]wwD=OwwptpwwwH{GwI]<j:ywwDD
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948451996 CET1286INData Raw: 6b b4 92 9a 24 b9 c3 6d c5 dc f2 fa 4b a7 43 32 f4 5a 94 ac 7a 1c 77 91 48 54 95 e0 98 e8 1f 4c 70 89 21 80 6a 17 20 89 43 40 84 6a 48 ed 42 55 13 42 70 07 af 46 a2 d3 20 2b 5a 05 c7 05 c1 9b 23 2d 3b 28 40 3d 29 72 6c 86 9d 35 69 1c b2 d1 d0 14
                                                                                                                                                                                                      Data Ascii: k$mKC2ZzwHTLp!j C@jHBUBpF +Z#-;(@=)rl5iP`<2kV6]wJ?6}vyHt"-;U4di\yj8j_ZE9V,RR1IGpD5E.D2\"L5K*IrQIP -)fQ%0%Z,
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948470116 CET1286INData Raw: 0a b1 42 34 60 d6 66 a9 63 8d 01 69 7b 36 a8 d9 5b 4c da 81 05 0b 6c 60 fa 2a 30 a1 c9 d3 23 ab a5 9b 96 a9 ea 67 ed e9 9a 95 68 59 d0 06 50 e9 1a 29 ea 67 67 a0 b4 92 7c 54 00 c4 d3 46 1b 79 6c 1e 32 02 93 c5 c2 8b 32 bd c8 75 2a 6c ed 5c ad 5c
                                                                                                                                                                                                      Data Ascii: B4`fci{6[Ll`*0#ghYP)gg|TFyl22u*l\\Ip\D9-v7|Co~>F~x`jhzd0m6Y^Yd$fSj0Vk;O]}G#-tvn(zBl 9#tsz2]&
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948482037 CET1286INData Raw: 68 d1 54 ab 7c 0c b4 18 16 7f 6c 98 d5 f2 be ab 93 b3 47 07 69 2e 7d d9 35 97 8a 59 8a 45 e6 b3 29 5f 5c 9d 65 63 73 75 52 d4 b0 65 b8 47 d9 e6 f4 1e 42 79 c3 b0 cb dc 9b 62 79 1f 53 e6 bd 3e 20 fb 4f 1d ee b3 bf 9b ec 87 d1 ed 09 e3 bf a1 86 fa
                                                                                                                                                                                                      Data Ascii: hT|lGi.}5YE)_\ecsuReGBybyS> Owfce<m<\gj+9e8l1i&65\s+/{mdXz`Al":[]-^]>~g?S*G{*i~#f?4_
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948498964 CET1286INData Raw: 69 f4 f7 90 4b 25 e5 28 3d 14 94 e2 ea 60 6a f4 c6 40 b5 3c 6f 76 0e 6f 78 2f 45 b4 fa 2d 25 d3 f2 bb bc b0 d4 af bf e4 0a 45 7d f2 d0 f4 7e 48 38 69 e9 3c fb 21 61 7e 87 f3 df 5f cb a7 a3 15 c5 e2 fa 29 5a d5 d4 83 0b ab 28 d2 14 e1 64 81 74 b6
                                                                                                                                                                                                      Data Ascii: iK%(=`j@<ovox/E-%E}~H8i<!a~_)Z(dt<'y?uUEz||klq'"m[7K;*:y9=xy711WMmp4+r:5kf8[ERjz\idM-M
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948512077 CET1286INData Raw: 7d ce 15 fa 9a 3d bc 34 b6 92 18 6a df a0 77 1f cc ee 6f 79 1d 4e 0d fc ae c2 8c ea 94 f0 9e fb e7 be a7 15 67 af e9 72 27 a4 86 8c b1 d2 c3 55 5b 54 37 8b 55 61 79 d2 e7 58 d2 c9 51 c2 7e ee 99 ce f8 7e 96 f6 7b be 27 2b dc dd f1 1e c5 ac 1f 25
                                                                                                                                                                                                      Data Ascii: }=4jwoyNgr'U[T7UayXQ~~{'+%q"Ur_^y{xy}22tGS1y<eB=\(L(oUzC"\:]Ne4\QYp!cbr^+mKS_[fFUr0}$}g>dl|E=cW
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948528051 CET1286INData Raw: 78 1f 79 e0 e2 a9 6a 13 d1 e1 bb 69 b3 14 32 88 ea ab 30 41 2f 0d d6 a4 15 60 61 13 58 01 c7 4b 4c 64 6b e4 b4 1d 9c bd 66 ad 13 19 69 71 da a3 b7 5e 15 2c 75 db 6b 2d c5 99 a8 6a b7 ae 3b fa ef 47 e1 bd bf cd fb 58 cd ba 2a c7 29 ed 31 13 84 30
                                                                                                                                                                                                      Data Ascii: xyji20A/`aXKLdkfiq^,uk-j;GX*)10-Gwm~{[).s,3Ih,VV(^#!zzp,;1|_}J8qGW8Z~{-kFXyz:-;EjcJmAmjrU{VjX^)yH{q
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.948544979 CET1286INData Raw: 93 8a 8f d1 46 ae 21 31 8e ab 66 18 5b 63 ed 16 ea f0 7a 0e b7 8b a1 9e 83 c7 38 fb bc fc b0 58 7e a7 92 4b d6 b5 36 61 47 a6 b5 78 37 c3 5c 13 36 1d 33 b8 74 e8 19 83 79 0b 9a cd 89 53 42 52 06 32 53 99 31 6b 21 89 86 33 bb ae fa 92 d4 6d 71 da
                                                                                                                                                                                                      Data Ascii: F!1f[cz8X~K6aGx7\63tySBR2S1k!3mqdao!SskVofjkVjgk3n|;gz>W}37=?{>C=({^y@9Cug't<G8<xzKhJsox[f=v6F;|
                                                                                                                                                                                                      Dec 29, 2023 00:21:10.952131987 CET1286INData Raw: 49 31 49 b9 6a 81 99 a9 28 61 8c 5d 61 8a 4c 22 0c 25 50 6e 5a c9 7e f4 96 7d 4e 1b 92 b8 13 0d 4b 7b ce f7 0d 4a 3a 36 87 29 d8 46 d3 3d 3d 9c cd 6f 0b df c0 ab b6 55 a4 46 05 c9 d3 89 76 d3 e9 cb 56 1a 47 23 c7 a8 c0 3d af 20 75 a8 af 31 d8 56
                                                                                                                                                                                                      Data Ascii: I1Ij(a]aL"%PnZ~}NK{J:6)F==oUFvVG#= u1VqQ}z=os3^P%g:BT/Ta<pIpVa3tj!4/;*Drq6#(7QmKXk&&,g9 C4^#W#4U:7H


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      10192.168.2.8497361.192.137.108804656C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:13.175393105 CET346OUTGET /wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa&w=6.2&t=6671437&active=0 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Language: zh-CN
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
                                                                                                                                                                                                      Host: res.qhupdate.com
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:25.534214973 CET290INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:25 GMT
                                                                                                                                                                                                      Content-Type: text/plain
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      Keep-Alive: timeout=20
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      X-Powered-By: PHP/5.3.10
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                      Data Ascii: 140


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      11192.168.2.849764171.8.167.89806116C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.521137953 CET940OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32664&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.834193945 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:34 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:34.834882975 CET390OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=32713&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.148144960 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:34 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.439212084 CET381OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=122367&r2=3671 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.752511978 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:35 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:35.893788099 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=5251 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.206840992 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:36 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:39.808753967 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=18212 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.121747017 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:39 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.362438917 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=6873 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:46.676083088 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:46 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.358885050 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=29683 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:21:53.672358990 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:53 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Dec 29, 2023 00:22:01.863946915 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=08bcc5cf9e3fc589107741a5e999ecfa&ver=2.6.0.1110&r1=0&r2=24722 HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Dec 29, 2023 00:22:02.177149057 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:22:02 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:15 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "5bd6a4bf-0"
                                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                      12192.168.2.849765101.198.2.14780
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.027446985 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Dec 29, 2023 00:21:36.348258018 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:36 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:32:04 GMT
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      ETag: "6295d284-0"
                                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                      13192.168.2.849768101.198.2.14780
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.043870926 CET180OUTGET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=08bcc5cf9e3fc589107741a5e999ecfa HTTP/1.0
                                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      Dec 29, 2023 00:21:40.356060982 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:21:40 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:33 GMT
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      ETag: "6295d265-0"
                                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                      Start time:00:19:54
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                                      Imagebase:0xbd0000
                                                                                                                                                                                                      File size:22'004'296 bytes
                                                                                                                                                                                                      MD5 hash:AAE3EEDBDC1B1A99F7C2844F85352692
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                      Start time:00:20:06
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                      Start time:00:20:06
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:5
                                                                                                                                                                                                      Start time:00:20:06
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                      Start time:00:20:39
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe"
                                                                                                                                                                                                      Imagebase:0xb60000
                                                                                                                                                                                                      File size:256'872 bytes
                                                                                                                                                                                                      MD5 hash:DEC58427DAFCCF050DA9AC893E28407C
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                                      Start time:00:20:40
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                                      Start time:00:20:41
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:14
                                                                                                                                                                                                      Start time:00:20:41
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:15
                                                                                                                                                                                                      Start time:00:20:42
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline: /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                                      Imagebase:0x7ff7c8c30000
                                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                                      Start time:00:20:42
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S
                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                      File size:1'412'584 bytes
                                                                                                                                                                                                      MD5 hash:32DC2FA6DB8B8809B12A8CAD215C69FD
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:17
                                                                                                                                                                                                      Start time:00:20:42
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian
                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                      File size:1'746'672 bytes
                                                                                                                                                                                                      MD5 hash:02C91D3BE856789E1711C37649F382CC
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:19
                                                                                                                                                                                                      Start time:00:20:44
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe" onlyimport
                                                                                                                                                                                                      Imagebase:0xca0000
                                                                                                                                                                                                      File size:385'200 bytes
                                                                                                                                                                                                      MD5 hash:28580334E670277D005E38D4C9E65CFD
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:21
                                                                                                                                                                                                      Start time:00:20:49
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
                                                                                                                                                                                                      Imagebase:0x560000
                                                                                                                                                                                                      File size:206'000 bytes
                                                                                                                                                                                                      MD5 hash:B70E8845A3DFB674910975E6D0C061EC
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:24
                                                                                                                                                                                                      Start time:00:20:51
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                      Imagebase:0x7ff62d7d0000
                                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:25
                                                                                                                                                                                                      Start time:00:20:54
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 4084 -s 10344
                                                                                                                                                                                                      Imagebase:0x7ff7d88b0000
                                                                                                                                                                                                      File size:570'736 bytes
                                                                                                                                                                                                      MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:26
                                                                                                                                                                                                      Start time:00:20:57
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:explorer.exe
                                                                                                                                                                                                      Imagebase:0x7ff62d7d0000
                                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:27
                                                                                                                                                                                                      Start time:00:20:57
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe StartByDesktop StartFrom=4
                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                      File size:947'888 bytes
                                                                                                                                                                                                      MD5 hash:B8B17E96DFCB39621A7D886528D1FACC
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:28
                                                                                                                                                                                                      Start time:00:21:03
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
                                                                                                                                                                                                      Imagebase:0xa10000
                                                                                                                                                                                                      File size:1'664'832 bytes
                                                                                                                                                                                                      MD5 hash:F9093B9504ABF8EE62BAF4B74D665841
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:31
                                                                                                                                                                                                      Start time:00:21:05
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 3748 -s 5128
                                                                                                                                                                                                      Imagebase:0x7ff7d88b0000
                                                                                                                                                                                                      File size:570'736 bytes
                                                                                                                                                                                                      MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:32
                                                                                                                                                                                                      Start time:00:21:06
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:explorer.exe
                                                                                                                                                                                                      Imagebase:0x7ff62d7d0000
                                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:33
                                                                                                                                                                                                      Start time:00:21:07
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe" /unloaddtswitcher
                                                                                                                                                                                                      Imagebase:0x7ff773170000
                                                                                                                                                                                                      File size:163'968 bytes
                                                                                                                                                                                                      MD5 hash:476B86E7D05550919702E25541927DA5
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:34
                                                                                                                                                                                                      Start time:00:21:09
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:35
                                                                                                                                                                                                      Start time:00:21:09
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline: /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                                      Imagebase:0x7ff7c8c30000
                                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:37
                                                                                                                                                                                                      Start time:00:21:11
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:38
                                                                                                                                                                                                      Start time:00:21:11
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe" -ReportWallPaper
                                                                                                                                                                                                      Imagebase:0xa10000
                                                                                                                                                                                                      File size:1'664'832 bytes
                                                                                                                                                                                                      MD5 hash:F9093B9504ABF8EE62BAF4B74D665841
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:39
                                                                                                                                                                                                      Start time:00:21:12
                                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
                                                                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 03D9E82F Relevance: 1.7, Instructions: 1670COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000003.1635290327.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp, Offset: 03D9A000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_3d9a000_SecuriteInfo.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: b66810b90209b51c6fe2b8b995de4d88cb494535a45e0e53aa844f1deced088e
                                                                                                                                                                                                        • Instruction ID: 8cef9e570be989630cf8053c71a17f22fd97b166bf36b98445bc8781368b643f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b66810b90209b51c6fe2b8b995de4d88cb494535a45e0e53aa844f1deced088e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FFA2AD6140E7D19FDB138BB89CA86417FB0AF17624B4A46DBC4D1CF0EBD628181AD727
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                        Execution Coverage:6.2%
                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                        Signature Coverage:6.1%
                                                                                                                                                                                                        Total number of Nodes:2000
                                                                                                                                                                                                        Total number of Limit Nodes:85
                                                                                                                                                                                                        execution_graph 17228 b7227f 17265 b76ff8 17228->17265 17230 b7228b GetStartupInfoW 17231 b722ae 17230->17231 17266 b76355 HeapCreate 17231->17266 17234 b722fe 17268 b775a7 GetModuleHandleW 17234->17268 17238 b7230f __RTC_Initialize 17302 b7c3d6 17238->17302 17239 b72256 _fast_error_exit 61 API calls 17239->17238 17241 b7231d 17242 b72329 GetCommandLineW 17241->17242 17470 b77764 17241->17470 17317 b7c379 GetEnvironmentStringsW 17242->17317 17246 b72338 17323 b7c2cb GetModuleFileNameW 17246->17323 17248 b72342 17249 b7234d 17248->17249 17250 b77764 __amsg_exit 61 API calls 17248->17250 17327 b7c09c 17249->17327 17250->17249 17254 b77764 __amsg_exit 61 API calls 17256 b7235e 17254->17256 17255 b72365 17257 b77764 __amsg_exit 61 API calls 17255->17257 17258 b72370 __wwincmdln 17255->17258 17340 b77823 17256->17340 17257->17258 17346 b63070 17258->17346 17261 b7239f 17477 b77a00 17261->17477 17264 b723a4 ___BuildCatchObject 17265->17230 17267 b722f2 17266->17267 17267->17234 17462 b72256 17267->17462 17269 b775c2 17268->17269 17270 b775bb 17268->17270 17272 b775cc GetProcAddress GetProcAddress GetProcAddress GetProcAddress 17269->17272 17273 b7772a 17269->17273 17480 b77734 17270->17480 17275 b77615 TlsAlloc 17272->17275 17539 b772c1 17273->17539 17278 b72304 17275->17278 17279 b77663 TlsSetValue 17275->17279 17278->17238 17278->17239 17279->17278 17280 b77674 17279->17280 17484 b77a1e 17280->17484 17285 b77197 __encode_pointer 6 API calls 17286 b77694 17285->17286 17287 b77197 __encode_pointer 6 API calls 17286->17287 17288 b776a4 17287->17288 17289 b77197 __encode_pointer 6 API calls 17288->17289 17290 b776b4 17289->17290 17501 b76385 17290->17501 17297 b77212 __decode_pointer 6 API calls 17298 b77708 17297->17298 17298->17273 17299 b7770f 17298->17299 17521 b772fe 17299->17521 17301 b77717 GetCurrentThreadId 17301->17278 17846 b76ff8 17302->17846 17304 b7c3e2 GetStartupInfoA 17305 b746ca __calloc_crt 61 API calls 17304->17305 17307 b7c403 17305->17307 17306 b7c621 ___BuildCatchObject 17306->17241 17307->17306 17309 b746ca __calloc_crt 61 API calls 17307->17309 17312 b7c568 17307->17312 17316 b7c4eb 17307->17316 17308 b7c59e GetStdHandle 17308->17312 17309->17307 17310 b7c603 SetHandleCount 17310->17306 17311 b7c5b0 GetFileType 17311->17312 17312->17306 17312->17308 17312->17310 17312->17311 17314 b801ac __alloc_osfhnd InitializeCriticalSectionAndSpinCount 17312->17314 17313 b7c514 GetFileType 17313->17316 17314->17312 17315 b801ac __alloc_osfhnd InitializeCriticalSectionAndSpinCount 17315->17316 17316->17306 17316->17312 17316->17313 17316->17315 17318 b7c38e 17317->17318 17319 b7c38a 17317->17319 17320 b74685 __malloc_crt 61 API calls 17318->17320 17319->17246 17322 b7c3af _memcpy_s 17320->17322 17321 b7c3b6 FreeEnvironmentStringsW 17321->17246 17322->17321 17324 b7c300 _wparse_cmdline 17323->17324 17325 b74685 __malloc_crt 61 API calls 17324->17325 17326 b7c343 _wparse_cmdline 17324->17326 17325->17326 17326->17248 17328 b7c0b4 _wcslen 17327->17328 17332 b72353 17327->17332 17329 b746ca __calloc_crt 61 API calls 17328->17329 17335 b7c0d8 _wcslen 17329->17335 17330 b7c13d 17331 b7108d ___init_ctype 61 API calls 17330->17331 17331->17332 17332->17254 17332->17256 17333 b746ca __calloc_crt 61 API calls 17333->17335 17334 b7c163 17336 b7108d ___init_ctype 61 API calls 17334->17336 17335->17330 17335->17332 17335->17333 17335->17334 17338 b7c122 17335->17338 17847 b84251 17335->17847 17336->17332 17338->17335 17339 b711fb __invoke_watson 10 API calls 17338->17339 17339->17338 17342 b77831 __IsNonwritableInCurrentImage 17340->17342 17856 b8020c 17342->17856 17343 b7784f __initterm_e 17345 b7786e __IsNonwritableInCurrentImage __initterm 17343->17345 17860 b71a1c 17343->17860 17345->17255 17347 b63105 _memset 17346->17347 17960 b700c0 17347->17960 17351 b63143 17982 b62f30 17351->17982 17353 b6314e 17354 b64c60 73 API calls 17353->17354 17458 b63152 ctype 17353->17458 17355 b631d8 17354->17355 17998 b64ac0 17355->17998 17357 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17359 b63b67 17357->17359 17359->17261 17459 b779d4 17359->17459 17361 b631fa 17362 b64ac0 73 API calls 17361->17362 17363 b6320a 17362->17363 18020 b64750 17363->18020 17365 b63228 18034 b66d20 17365->18034 17371 b63258 17372 b63a9c 17371->17372 17373 b63270 17371->17373 17374 b67130 InternetCloseHandle 17372->17374 17375 b63283 17373->17375 18155 b71349 17373->18155 17374->17458 18158 b63bd0 17375->18158 17458->17357 20585 b778a8 17459->20585 17461 b779e5 17461->17261 17463 b72264 17462->17463 17464 b72269 17462->17464 17465 b77c17 __FF_MSGBANNER 61 API calls 17463->17465 17466 b77a6c __NMSG_WRITE 61 API calls 17464->17466 17465->17464 17467 b72271 17466->17467 17468 b777b8 _malloc 3 API calls 17467->17468 17469 b7227b 17468->17469 17469->17234 17471 b77c17 __FF_MSGBANNER 61 API calls 17470->17471 17472 b7776e 17471->17472 17473 b77a6c __NMSG_WRITE 61 API calls 17472->17473 17474 b77776 17473->17474 17475 b77212 __decode_pointer 6 API calls 17474->17475 17476 b72328 17475->17476 17476->17242 17478 b778a8 _doexit 61 API calls 17477->17478 17479 b77a0b 17478->17479 17479->17264 17481 b7773f Sleep GetModuleHandleW 17480->17481 17482 b775c1 17481->17482 17483 b7775d 17481->17483 17482->17269 17483->17481 17483->17482 17545 b77209 17484->17545 17486 b77a26 __init_pointers __initp_misc_winsig 17548 b7c790 17486->17548 17489 b77197 __encode_pointer 6 API calls 17490 b77679 17489->17490 17491 b77197 TlsGetValue 17490->17491 17492 b771d0 GetModuleHandleW 17491->17492 17493 b771af 17491->17493 17495 b771e0 17492->17495 17496 b771eb GetProcAddress 17492->17496 17493->17492 17494 b771b9 TlsGetValue 17493->17494 17498 b771c4 17494->17498 17497 b77734 __crt_waiting_on_module_handle 2 API calls 17495->17497 17500 b771c8 17496->17500 17499 b771e6 17497->17499 17498->17492 17498->17500 17499->17496 17499->17500 17500->17285 17502 b76390 17501->17502 17504 b763be 17502->17504 17551 b801ac 17502->17551 17504->17273 17505 b77212 TlsGetValue 17504->17505 17506 b7724b GetModuleHandleW 17505->17506 17507 b7722a 17505->17507 17509 b77266 GetProcAddress 17506->17509 17510 b7725b 17506->17510 17507->17506 17508 b77234 TlsGetValue 17507->17508 17513 b7723f 17508->17513 17511 b77243 17509->17511 17512 b77734 __crt_waiting_on_module_handle 2 API calls 17510->17512 17511->17273 17515 b746ca 17511->17515 17514 b77261 17512->17514 17513->17506 17513->17511 17514->17509 17514->17511 17518 b746d3 17515->17518 17517 b74710 17517->17273 17517->17297 17518->17517 17519 b746f1 Sleep 17518->17519 17556 b7fb56 17518->17556 17520 b74706 17519->17520 17520->17517 17520->17518 17825 b76ff8 17521->17825 17523 b7730a GetModuleHandleW 17524 b77320 17523->17524 17525 b7731a 17523->17525 17527 b7735c 17524->17527 17528 b77338 GetProcAddress GetProcAddress 17524->17528 17526 b77734 __crt_waiting_on_module_handle 2 API calls 17525->17526 17526->17524 17529 b76501 __lock 58 API calls 17527->17529 17528->17527 17530 b7737b 17529->17530 17826 b773d3 17530->17826 17533 b76501 __lock 58 API calls 17534 b7739c 17533->17534 17829 b72bcb InterlockedIncrement 17534->17829 17536 b773ba 17841 b773dc 17536->17841 17538 b773c7 ___BuildCatchObject 17538->17301 17540 b772d7 17539->17540 17541 b772cb 17539->17541 17542 b772eb TlsFree 17540->17542 17543 b772f9 17540->17543 17544 b77212 __decode_pointer 6 API calls 17541->17544 17542->17543 17543->17543 17544->17540 17546 b77197 __encode_pointer 6 API calls 17545->17546 17547 b77210 17546->17547 17547->17486 17549 b77197 __encode_pointer 6 API calls 17548->17549 17550 b77a58 17549->17550 17550->17489 17555 b76ff8 17551->17555 17553 b801b8 InitializeCriticalSectionAndSpinCount 17554 b801fc ___BuildCatchObject 17553->17554 17554->17502 17555->17553 17557 b7fb62 ___BuildCatchObject 17556->17557 17558 b7fb7a 17557->17558 17568 b7fb99 _memset 17557->17568 17569 b747a6 17558->17569 17561 b7fc0b RtlAllocateHeap 17561->17568 17565 b7fb8f ___BuildCatchObject 17565->17518 17568->17561 17568->17565 17575 b76501 17568->17575 17582 b76d13 17568->17582 17588 b7fc52 17568->17588 17591 b77167 17568->17591 17594 b773e5 GetLastError 17569->17594 17571 b747ab 17572 b71323 17571->17572 17573 b77212 __decode_pointer 6 API calls 17572->17573 17574 b71333 __invoke_watson 17573->17574 17576 b76516 17575->17576 17577 b76529 EnterCriticalSection 17575->17577 17619 b7643e 17576->17619 17577->17568 17579 b7651c 17579->17577 17580 b77764 __amsg_exit 60 API calls 17579->17580 17581 b76528 17580->17581 17581->17577 17585 b76d41 17582->17585 17583 b76dda 17587 b76de3 17583->17587 17820 b7692a 17583->17820 17585->17583 17585->17587 17813 b7687a 17585->17813 17587->17568 17824 b76427 LeaveCriticalSection 17588->17824 17590 b7fc59 17590->17568 17592 b77212 __decode_pointer 6 API calls 17591->17592 17593 b77177 17592->17593 17593->17568 17608 b7728d TlsGetValue 17594->17608 17597 b77452 SetLastError 17597->17571 17598 b746ca __calloc_crt 58 API calls 17599 b77410 17598->17599 17599->17597 17600 b77212 __decode_pointer 6 API calls 17599->17600 17601 b7742a 17600->17601 17602 b77431 17601->17602 17603 b77449 17601->17603 17604 b772fe __initptd 58 API calls 17602->17604 17613 b7108d 17603->17613 17606 b77439 GetCurrentThreadId 17604->17606 17606->17597 17607 b7744f 17607->17597 17609 b772a2 17608->17609 17610 b772bd 17608->17610 17611 b77212 __decode_pointer 6 API calls 17609->17611 17610->17597 17610->17598 17612 b772ad TlsSetValue 17611->17612 17612->17610 17614 b71099 ___BuildCatchObject 17613->17614 17615 b71115 ___BuildCatchObject 17614->17615 17616 b710ec HeapFree 17614->17616 17615->17607 17616->17615 17617 b710ff 17616->17617 17618 b747a6 _memcpy_s 60 API calls 17617->17618 17618->17615 17620 b7644a ___BuildCatchObject 17619->17620 17621 b76470 17620->17621 17645 b77c17 17620->17645 17627 b76480 ___BuildCatchObject 17621->17627 17691 b74685 17621->17691 17627->17579 17629 b76492 17633 b747a6 _memcpy_s 61 API calls 17629->17633 17630 b764a1 17631 b76501 __lock 61 API calls 17630->17631 17634 b764a8 17631->17634 17633->17627 17635 b764b0 17634->17635 17636 b764dc 17634->17636 17637 b801ac __alloc_osfhnd InitializeCriticalSectionAndSpinCount 17635->17637 17638 b7108d ___init_ctype 61 API calls 17636->17638 17639 b764bb 17637->17639 17640 b764cd 17638->17640 17639->17640 17642 b7108d ___init_ctype 61 API calls 17639->17642 17697 b764f8 17640->17697 17643 b764c7 17642->17643 17644 b747a6 _memcpy_s 61 API calls 17643->17644 17644->17640 17700 b803a5 17645->17700 17648 b77c2b 17650 b77a6c __NMSG_WRITE 61 API calls 17648->17650 17653 b7645f 17648->17653 17649 b803a5 __set_error_mode 61 API calls 17649->17648 17651 b77c43 17650->17651 17652 b77a6c __NMSG_WRITE 61 API calls 17651->17652 17652->17653 17654 b77a6c 17653->17654 17655 b77a80 17654->17655 17656 b803a5 __set_error_mode 58 API calls 17655->17656 17687 b76466 17655->17687 17657 b77aa2 17656->17657 17658 b77be0 GetStdHandle 17657->17658 17660 b803a5 __set_error_mode 58 API calls 17657->17660 17659 b77bee _strlen 17658->17659 17658->17687 17663 b77c07 WriteFile 17659->17663 17659->17687 17661 b77ab3 17660->17661 17661->17658 17662 b77ac5 17661->17662 17662->17687 17706 b75f82 17662->17706 17663->17687 17666 b77afb GetModuleFileNameA 17668 b77b19 17666->17668 17674 b77b3c _strlen 17666->17674 17670 b75f82 _strcpy_s 58 API calls 17668->17670 17671 b77b29 17670->17671 17673 b711fb __invoke_watson 10 API calls 17671->17673 17671->17674 17672 b77b7f 17731 b7d59d 17672->17731 17673->17674 17674->17672 17722 b7d611 17674->17722 17679 b77ba3 17681 b7d59d _strcat_s 58 API calls 17679->17681 17680 b711fb __invoke_watson 10 API calls 17680->17679 17682 b77bb7 17681->17682 17684 b77bc8 17682->17684 17685 b711fb __invoke_watson 10 API calls 17682->17685 17683 b711fb __invoke_watson 10 API calls 17683->17672 17740 b8023c 17684->17740 17685->17684 17688 b777b8 17687->17688 17778 b7778d GetModuleHandleW 17688->17778 17694 b7468e 17691->17694 17693 b746c4 17693->17629 17693->17630 17694->17693 17695 b746a5 Sleep 17694->17695 17782 b713a8 17694->17782 17696 b746ba 17695->17696 17696->17693 17696->17694 17812 b76427 LeaveCriticalSection 17697->17812 17699 b764ff 17699->17627 17701 b803b4 17700->17701 17702 b747a6 _memcpy_s 61 API calls 17701->17702 17705 b77c1e 17701->17705 17703 b803d7 17702->17703 17704 b71323 _memcpy_s 6 API calls 17703->17704 17704->17705 17705->17648 17705->17649 17707 b75f93 17706->17707 17708 b75f9a 17706->17708 17707->17708 17713 b75fc0 17707->17713 17709 b747a6 _memcpy_s 61 API calls 17708->17709 17710 b75f9f 17709->17710 17711 b71323 _memcpy_s 6 API calls 17710->17711 17712 b75fae 17711->17712 17712->17666 17715 b711fb 17712->17715 17713->17712 17714 b747a6 _memcpy_s 61 API calls 17713->17714 17714->17710 17767 b75ae0 17715->17767 17717 b71228 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17718 b71304 GetCurrentProcess TerminateProcess 17717->17718 17719 b712f8 __invoke_watson 17717->17719 17769 b70d52 17718->17769 17719->17718 17721 b71321 17721->17666 17727 b7d623 17722->17727 17723 b7d627 17724 b77b6c 17723->17724 17725 b747a6 _memcpy_s 61 API calls 17723->17725 17724->17672 17724->17683 17726 b7d643 17725->17726 17728 b71323 _memcpy_s 6 API calls 17726->17728 17727->17723 17727->17724 17729 b7d66d 17727->17729 17728->17724 17729->17724 17730 b747a6 _memcpy_s 61 API calls 17729->17730 17730->17726 17732 b7d5b5 17731->17732 17735 b7d5ae 17731->17735 17733 b747a6 _memcpy_s 61 API calls 17732->17733 17734 b7d5ba 17733->17734 17736 b71323 _memcpy_s 6 API calls 17734->17736 17735->17732 17737 b7d5e9 17735->17737 17738 b77b92 17736->17738 17737->17738 17739 b747a6 _memcpy_s 61 API calls 17737->17739 17738->17679 17738->17680 17739->17734 17741 b77209 _raise 6 API calls 17740->17741 17742 b8024c 17741->17742 17743 b8025f LoadLibraryA 17742->17743 17745 b802e7 17742->17745 17744 b80274 GetProcAddress 17743->17744 17752 b80389 17743->17752 17746 b8028a 17744->17746 17744->17752 17750 b77212 __decode_pointer 6 API calls 17745->17750 17762 b80311 17745->17762 17747 b77197 __encode_pointer 6 API calls 17746->17747 17751 b80290 GetProcAddress 17747->17751 17748 b77212 __decode_pointer 6 API calls 17748->17752 17749 b77212 __decode_pointer 6 API calls 17759 b80354 17749->17759 17753 b80304 17750->17753 17755 b77197 __encode_pointer 6 API calls 17751->17755 17752->17687 17754 b77212 __decode_pointer 6 API calls 17753->17754 17754->17762 17756 b802a5 GetProcAddress 17755->17756 17757 b77197 __encode_pointer 6 API calls 17756->17757 17758 b802ba GetProcAddress 17757->17758 17760 b77197 __encode_pointer 6 API calls 17758->17760 17761 b77212 __decode_pointer 6 API calls 17759->17761 17764 b8033c 17759->17764 17763 b802cf 17760->17763 17761->17764 17762->17749 17762->17764 17763->17745 17765 b802d9 GetProcAddress 17763->17765 17764->17748 17766 b77197 __encode_pointer 6 API calls 17765->17766 17766->17745 17768 b75aec __VEC_memzero 17767->17768 17768->17717 17770 b70d5c IsDebuggerPresent 17769->17770 17771 b70d5a 17769->17771 17777 b7718f 17770->17777 17771->17721 17774 b75f49 SetUnhandledExceptionFilter UnhandledExceptionFilter 17775 b75f6e GetCurrentProcess TerminateProcess 17774->17775 17776 b75f66 __invoke_watson 17774->17776 17775->17721 17776->17775 17777->17774 17779 b777b6 ExitProcess 17778->17779 17780 b777a1 GetProcAddress 17778->17780 17780->17779 17781 b777b1 17780->17781 17781->17779 17783 b7145b 17782->17783 17789 b713ba 17782->17789 17784 b77167 _realloc 6 API calls 17783->17784 17786 b71461 17784->17786 17785 b713cb 17787 b77c17 __FF_MSGBANNER 60 API calls 17785->17787 17785->17789 17790 b77a6c __NMSG_WRITE 60 API calls 17785->17790 17793 b777b8 _malloc 3 API calls 17785->17793 17788 b747a6 _memcpy_s 60 API calls 17786->17788 17787->17785 17794 b71453 17788->17794 17789->17785 17792 b71417 RtlAllocateHeap 17789->17792 17789->17794 17795 b71447 17789->17795 17796 b77167 _realloc 6 API calls 17789->17796 17798 b7144c 17789->17798 17800 b71359 17789->17800 17790->17785 17792->17789 17793->17785 17794->17694 17797 b747a6 _memcpy_s 60 API calls 17795->17797 17796->17789 17797->17798 17799 b747a6 _memcpy_s 60 API calls 17798->17799 17799->17794 17801 b71365 ___BuildCatchObject 17800->17801 17802 b71396 ___BuildCatchObject 17801->17802 17803 b76501 __lock 61 API calls 17801->17803 17802->17789 17804 b7137b 17803->17804 17805 b76d13 ___sbh_alloc_block 5 API calls 17804->17805 17806 b71386 17805->17806 17808 b7139f 17806->17808 17811 b76427 LeaveCriticalSection 17808->17811 17810 b713a6 17810->17802 17811->17810 17812->17699 17814 b768c1 HeapAlloc 17813->17814 17815 b7688d HeapReAlloc 17813->17815 17817 b768ab 17814->17817 17818 b768e4 VirtualAlloc 17814->17818 17816 b768af 17815->17816 17815->17817 17816->17814 17817->17583 17818->17817 17819 b768fe HeapFree 17818->17819 17819->17817 17821 b76941 VirtualAlloc 17820->17821 17823 b76988 17821->17823 17823->17587 17824->17590 17825->17523 17844 b76427 LeaveCriticalSection 17826->17844 17828 b77395 17828->17533 17830 b72bec 17829->17830 17831 b72be9 InterlockedIncrement 17829->17831 17832 b72bf6 InterlockedIncrement 17830->17832 17833 b72bf9 17830->17833 17831->17830 17832->17833 17834 b72c06 17833->17834 17835 b72c03 InterlockedIncrement 17833->17835 17836 b72c10 InterlockedIncrement 17834->17836 17837 b72c13 17834->17837 17835->17834 17836->17837 17838 b72c2c InterlockedIncrement 17837->17838 17839 b72c3c InterlockedIncrement 17837->17839 17840 b72c47 InterlockedIncrement 17837->17840 17838->17837 17839->17837 17840->17536 17845 b76427 LeaveCriticalSection 17841->17845 17843 b773e3 17843->17538 17844->17828 17845->17843 17846->17304 17848 b84269 17847->17848 17849 b84262 17847->17849 17850 b747a6 _memcpy_s 61 API calls 17848->17850 17849->17848 17853 b84295 17849->17853 17851 b8426e 17850->17851 17852 b71323 _memcpy_s 6 API calls 17851->17852 17854 b8427d 17852->17854 17853->17854 17855 b747a6 _memcpy_s 61 API calls 17853->17855 17854->17335 17855->17851 17857 b80212 17856->17857 17858 b77197 __encode_pointer 6 API calls 17857->17858 17859 b8022a 17857->17859 17858->17857 17859->17343 17863 b719e0 17860->17863 17862 b71a29 17862->17345 17864 b719ec ___BuildCatchObject 17863->17864 17871 b777d0 17864->17871 17870 b71a0d ___BuildCatchObject 17870->17862 17872 b76501 __lock 61 API calls 17871->17872 17873 b719f1 17872->17873 17874 b718f5 17873->17874 17875 b77212 __decode_pointer 6 API calls 17874->17875 17876 b71909 17875->17876 17877 b77212 __decode_pointer 6 API calls 17876->17877 17878 b71919 17877->17878 17879 b7199c 17878->17879 17894 b79d02 17878->17894 17891 b71a16 17879->17891 17881 b71983 17882 b77197 __encode_pointer 6 API calls 17881->17882 17883 b71991 17882->17883 17886 b77197 __encode_pointer 6 API calls 17883->17886 17884 b71937 17884->17881 17885 b7195b 17884->17885 17907 b74716 17884->17907 17885->17879 17888 b74716 __realloc_crt 71 API calls 17885->17888 17889 b71971 17885->17889 17886->17879 17888->17889 17889->17879 17890 b77197 __encode_pointer 6 API calls 17889->17890 17890->17881 17956 b777d9 17891->17956 17895 b79d0e ___BuildCatchObject 17894->17895 17896 b79d1e 17895->17896 17897 b79d3b 17895->17897 17898 b747a6 _memcpy_s 61 API calls 17896->17898 17899 b79d7c HeapSize 17897->17899 17900 b76501 __lock 61 API calls 17897->17900 17901 b79d23 17898->17901 17904 b79d33 ___BuildCatchObject 17899->17904 17903 b79d4b ___sbh_find_block 17900->17903 17902 b71323 _memcpy_s 6 API calls 17901->17902 17902->17904 17912 b79d9c 17903->17912 17904->17884 17909 b7471f 17907->17909 17910 b7475e 17909->17910 17911 b7473f Sleep 17909->17911 17916 b7fc74 17909->17916 17910->17885 17911->17909 17915 b76427 LeaveCriticalSection 17912->17915 17914 b79d77 17914->17899 17914->17904 17915->17914 17917 b7fc80 ___BuildCatchObject 17916->17917 17918 b7fc87 17917->17918 17919 b7fc95 17917->17919 17920 b713a8 _malloc 61 API calls 17918->17920 17921 b7fc9c 17919->17921 17922 b7fca8 17919->17922 17941 b7fc8f __dosmaperr ___BuildCatchObject 17920->17941 17923 b7108d ___init_ctype 61 API calls 17921->17923 17929 b7fe1a 17922->17929 17944 b7fcb5 _memcpy_s ___sbh_resize_block ___sbh_find_block 17922->17944 17923->17941 17924 b7fe4d 17926 b77167 _realloc 6 API calls 17924->17926 17925 b76501 __lock 61 API calls 17925->17944 17928 b7fe53 17926->17928 17927 b7fe1f HeapReAlloc 17927->17929 17927->17941 17930 b747a6 _memcpy_s 61 API calls 17928->17930 17929->17924 17929->17927 17931 b7fe71 17929->17931 17932 b77167 _realloc 6 API calls 17929->17932 17936 b7fe67 17929->17936 17930->17941 17933 b747a6 _memcpy_s 61 API calls 17931->17933 17931->17941 17932->17929 17935 b7fe7a GetLastError 17933->17935 17935->17941 17937 b747a6 _memcpy_s 61 API calls 17936->17937 17950 b7fde8 17937->17950 17938 b7fd40 HeapAlloc 17938->17944 17939 b7fd95 HeapReAlloc 17939->17944 17940 b7fded GetLastError 17940->17941 17941->17909 17942 b76d13 ___sbh_alloc_block 5 API calls 17942->17944 17943 b7fe00 17943->17941 17946 b747a6 _memcpy_s 61 API calls 17943->17946 17944->17924 17944->17925 17944->17938 17944->17939 17944->17941 17944->17942 17944->17943 17945 b77167 _realloc 6 API calls 17944->17945 17948 b7fde3 17944->17948 17951 b76564 __VEC_memcpy VirtualFree VirtualFree HeapFree ___sbh_free_block 17944->17951 17952 b7fdb8 17944->17952 17945->17944 17947 b7fe0d 17946->17947 17947->17935 17947->17941 17949 b747a6 _memcpy_s 61 API calls 17948->17949 17949->17950 17950->17940 17950->17941 17951->17944 17955 b76427 LeaveCriticalSection 17952->17955 17954 b7fdbf 17954->17944 17955->17954 17959 b76427 LeaveCriticalSection 17956->17959 17958 b71a1b 17958->17870 17959->17958 17963 b700e1 _memset 17960->17963 17971 b7016a 17960->17971 17961 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17962 b63119 17961->17962 17972 b64c60 17962->17972 17963->17971 18271 b6ff40 17963->18271 17965 b70117 _memset 17966 b70123 lstrlenA 17965->17966 17967 b70142 _strlwr_s_l_stat 17966->17967 17968 b7013e 17966->17968 18296 b6ec40 17967->18296 18300 b6ee50 17968->18300 17971->17961 17973 b64cb1 17972->17973 17976 b64c68 17972->17976 18965 b64da0 17973->18965 17975 b64ce1 17975->17351 17976->17973 17978 b64c92 17976->17978 17977 b64cbf 17977->17975 18972 b70efb 17977->18972 17980 b64750 73 API calls 17978->17980 17981 b64cac 17980->17981 17981->17351 17983 b75ae0 _memset 17982->17983 17984 b62f61 SHGetValueW 17983->17984 17985 b62fa2 _memset 17984->17985 17986 b6304b 17984->17986 17985->17986 17989 b62fc2 PathCombineW PathFileExistsW 17985->17989 17987 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17986->17987 17988 b6305b 17987->17988 17988->17353 17989->17986 17990 b62fec _memset 17989->17990 19122 b62e30 17990->19122 17992 b6301e 17992->17986 17993 b63024 17992->17993 19136 b63da0 17993->19136 17996 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17997 b63044 17996->17997 17997->17353 17999 b64ad7 17998->17999 18000 b64ad2 17998->18000 18002 b64afa 17999->18002 18003 b6e35d std::_String_base::_Xlen 73 API calls 17999->18003 18001 b6e395 std::_String_base::_Xlen 73 API calls 18000->18001 18001->17999 18004 b631ec 18002->18004 18005 b64da0 73 API calls 18002->18005 18003->18002 18008 b64b80 18004->18008 18006 b64b0a 18005->18006 18006->18004 18007 b70efb _memcpy_s 61 API calls 18006->18007 18007->18004 18009 b64bd5 18008->18009 18012 b64b90 18008->18012 18010 b64bed 18009->18010 18011 b6e35d std::_String_base::_Xlen 73 API calls 18009->18011 18013 b64da0 73 API calls 18010->18013 18019 b64c26 18010->18019 18011->18010 18012->18009 18015 b64bba 18012->18015 18014 b64bfd 18013->18014 18017 b70efb _memcpy_s 61 API calls 18014->18017 18014->18019 18016 b64ac0 73 API calls 18015->18016 18018 b64bce 18016->18018 18017->18019 18018->17361 18019->17361 18021 b64766 18020->18021 18022 b64761 18020->18022 18024 b64796 18021->18024 18025 b64779 18021->18025 18023 b6e395 std::_String_base::_Xlen 73 API calls 18022->18023 18023->18021 18027 b64da0 73 API calls 18024->18027 19157 b64d10 18025->19157 18032 b6479d 18027->18032 18029 b64d10 73 API calls 18031 b6478d 18029->18031 18030 b647d8 18030->17365 18031->17365 18032->18030 18033 b70efb _memcpy_s 61 API calls 18032->18033 18033->18030 18035 b66d80 WideCharToMultiByte 18034->18035 18036 b66d7c 18034->18036 18037 b66e44 18035->18037 18038 b66d9c 18035->18038 18036->18035 18039 b64570 std::_String_base::_Xlen 73 API calls 18037->18039 18040 b66e00 WideCharToMultiByte 18038->18040 18041 b66dae 18038->18041 18047 b66dcb ctype 18039->18047 18045 b66e30 18040->18045 18043 b64570 std::_String_base::_Xlen 73 API calls 18041->18043 18043->18047 18044 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18046 b63233 18044->18046 19163 b69040 18045->19163 18049 b670a0 18046->18049 18047->18044 19189 b685e0 18049->19189 18053 b67108 19204 b68770 18053->19204 18056 b671b0 18057 b671c2 __write_nolock 18056->18057 18058 b64570 std::_String_base::_Xlen 73 API calls 18057->18058 18059 b67221 18058->18059 19222 b66b60 18059->19222 18062 b6723c 18064 b6724f 18062->18064 18065 b680e0 InternetCloseHandle 18062->18065 18066 b67261 18064->18066 18068 b680e0 InternetCloseHandle 18064->18068 18065->18064 18067 b64c60 73 API calls 18066->18067 18069 b6728b 18067->18069 18068->18066 19236 b66ec0 18069->19236 18074 b672da 19252 b67890 18074->19252 18075 b70d72 std::exception::exception 61 API calls 18077 b672c9 18075->18077 18079 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 18077->18079 18079->18074 18080 b70d72 std::exception::exception 61 API calls 18082 b67311 18080->18082 18081 b6731f 19256 b67940 18081->19256 18084 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 18082->18084 18084->18081 18086 b67367 19260 b679f0 lstrlenW HttpAddRequestHeadersW 18086->19260 18087 b70d72 std::exception::exception 61 API calls 18089 b67356 18087->18089 18091 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 18089->18091 18091->18086 18092 b673a3 19262 b67a70 HttpSendRequestW 18092->19262 18093 b70d72 std::exception::exception 61 API calls 18095 b67395 18093->18095 18097 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 18095->18097 18097->18092 18098 b673b3 GetLastError 19264 b687c0 18098->19264 18101 b6742c 18102 b6745c 18101->18102 18106 b70d72 std::exception::exception 61 API calls 18101->18106 19300 b67be0 18102->19300 18107 b6744b 18106->18107 18110 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 18107->18110 18110->18102 18112 b64570 std::_String_base::_Xlen 73 API calls 18122 b674a0 18112->18122 18115 b6771f 18116 b70d72 std::exception::exception 61 API calls 18115->18116 18118 b67735 18116->18118 18120 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 18118->18120 18123 b67746 18120->18123 18122->18115 18124 b67be0 77 API calls 18122->18124 19393 b64650 18123->19393 18125 b674e7 18124->18125 18126 b64570 std::_String_base::_Xlen 73 API calls 18125->18126 18127 b674fe 18126->18127 18130 b67516 18127->18130 18131 b676f8 18127->18131 18132 b64570 std::_String_base::_Xlen 73 API calls 18130->18132 18133 b70d72 std::exception::exception 61 API calls 18131->18133 18135 b67529 18132->18135 18134 b6770e 18133->18134 18136 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 18134->18136 18137 b63bd0 std::_String_base::_Xlen 73 API calls 18135->18137 18136->18115 18138 b67536 18137->18138 19319 b67d80 18138->19319 18140 b67549 18151 b67566 _memcpy_s 18140->18151 18141 b685e0 73 API calls 18141->18151 18143 b675bd 19350 b68710 18143->19350 18147 b71349 6 API calls 18147->18151 18148 b686f0 6 API calls 18148->18151 18149 b675d8 18152 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18149->18152 18151->18141 18151->18143 18151->18147 18151->18148 19348 b68060 InternetReadFile 18151->19348 19357 b71d4a 18151->19357 19374 b69470 18151->19374 19386 b686d0 18151->19386 19390 b6b8f0 18151->19390 18154 b6762f 18152->18154 18154->17371 18156 b71323 _memcpy_s 6 API calls 18155->18156 18157 b71355 18156->18157 18157->17375 18159 b63bf0 18158->18159 18159->18159 18160 b64950 std::_Locinfo::_Locinfo_ctor 73 API calls 18159->18160 18161 b63295 18160->18161 18162 b6c4b0 18161->18162 19854 b6c190 18162->19854 18274 b6ff4a __write_nolock 18271->18274 18272 b700a9 18273 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18272->18273 18275 b700b9 18273->18275 18274->18272 18304 b6fcc0 18274->18304 18275->17965 18277 b6ff7f 18277->18272 18278 b6ff8a _memset 18277->18278 18316 b6fbf0 18278->18316 18282 b6ffb5 18285 b6ffee 18282->18285 18337 b6f290 18282->18337 18373 b6f850 18285->18373 18288 b6ffdb 18288->18285 18360 b6f5d0 18288->18360 18289 b7001c 18294 b7002f 18289->18294 18394 b6fa70 18289->18394 18409 b6eec0 18294->18409 18297 b6ec75 18296->18297 18298 b6ec49 18296->18298 18297->17968 18298->18297 18299 b6ec51 MultiByteToWideChar 18298->18299 18299->17968 18301 b6ee5d 18300->18301 18303 b6ee8b 18301->18303 18924 b75766 18301->18924 18303->17971 18305 b6fce4 _memset 18304->18305 18306 b6fe3d 18304->18306 18305->18306 18309 b6fd11 SHGetValueA 18305->18309 18307 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18306->18307 18308 b6fe4e 18307->18308 18308->18277 18309->18306 18310 b6fd43 _memset 18309->18310 18310->18306 18311 b6eec0 120 API calls 18310->18311 18312 b6fdfc lstrcmpiA 18311->18312 18312->18306 18313 b6fe16 18312->18313 18314 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18313->18314 18315 b6fe36 18314->18315 18315->18277 18317 b6fc73 18316->18317 18318 b6fc98 18317->18318 18428 b6edf0 18317->18428 18320 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18318->18320 18321 b6fcba 18320->18321 18322 b6f080 18321->18322 18323 b6f276 18322->18323 18324 b6f0a7 18322->18324 18325 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18323->18325 18324->18323 18336 b6f0b5 _memset 18324->18336 18326 b6f286 18325->18326 18326->18282 18327 b6edf0 95 API calls 18328 b6f0e8 CreateFileA 18327->18328 18329 b6f10f DeviceIoControl 18328->18329 18328->18336 18330 b6f152 CloseHandle 18329->18330 18329->18336 18330->18336 18331 b6f25a 18333 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18331->18333 18332 b6f242 CloseHandle 18332->18331 18332->18336 18334 b6f26f 18333->18334 18334->18282 18336->18327 18336->18331 18336->18332 18336->18336 18697 b70ce0 DeviceIoControl 18336->18697 18345 b6f2d0 _memset _strncpy 18337->18345 18338 b6edf0 95 API calls 18339 b6f2e8 CreateFileA 18338->18339 18339->18345 18340 b6f423 18341 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18340->18341 18342 b6f439 18341->18342 18342->18285 18346 b6f440 18342->18346 18343 b6f370 DeviceIoControl 18343->18345 18344 b6f40a CloseHandle 18344->18345 18345->18338 18345->18340 18345->18343 18345->18344 18347 b6f44a __write_nolock 18346->18347 18348 b6f5ab 18347->18348 18358 b6f47b _memset 18347->18358 18349 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18348->18349 18350 b6f5bc 18349->18350 18350->18288 18351 b6edf0 95 API calls 18352 b6f4a5 CreateFileA 18351->18352 18352->18358 18353 b6f58e 18354 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18353->18354 18356 b6f5a4 18354->18356 18355 b6f4ef DeviceIoControl 18357 b6f577 CloseHandle 18355->18357 18355->18358 18356->18288 18357->18353 18357->18358 18358->18351 18358->18353 18358->18355 18358->18357 18698 b70b60 18358->18698 18364 b6f600 18360->18364 18361 b6edf0 95 API calls 18362 b6f618 CreateFileA 18361->18362 18363 b6f643 DeviceIoControl 18362->18363 18362->18364 18363->18364 18364->18361 18365 b6f722 18364->18365 18367 b713a8 _malloc 61 API calls 18364->18367 18366 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18365->18366 18368 b6f738 18366->18368 18369 b6f690 DeviceIoControl 18367->18369 18368->18285 18370 b6f701 CloseHandle 18369->18370 18372 b6f6bd 18369->18372 18371 b7108d ___init_ctype 61 API calls 18370->18371 18371->18364 18372->18370 18374 b6fa51 18373->18374 18375 b6f878 _memset 18373->18375 18376 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18374->18376 18375->18374 18378 b6f894 RegOpenKeyExA 18375->18378 18377 b6fa62 18376->18377 18377->18289 18379 b6fa18 18378->18379 18380 b6f8b8 RegEnumKeyExA 18378->18380 18379->18374 18383 b6fa1f 18379->18383 18381 b6f8ea 18380->18381 18382 b6fa0b RegCloseKey 18380->18382 18384 b6f8f0 RegOpenKeyExA 18381->18384 18382->18379 18387 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18383->18387 18385 b6f914 RegQueryValueExA 18384->18385 18386 b6f9d9 RegEnumKeyExA 18384->18386 18388 b6f9ce RegCloseKey 18385->18388 18393 b6f94c _memset 18385->18393 18386->18384 18389 b6fa07 18386->18389 18390 b6fa4a 18387->18390 18388->18386 18389->18382 18390->18289 18392 b6f980 lstrcmpA 18392->18388 18392->18393 18393->18388 18393->18392 18865 b6f740 18393->18865 18395 b75ae0 _memset 18394->18395 18396 b6fa9a Netbios 18395->18396 18397 b6fac6 _memset 18396->18397 18398 b6fbca 18396->18398 18400 b6fadb Netbios 18397->18400 18399 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18398->18399 18401 b6fbdb 18399->18401 18402 b6faff _memset 18400->18402 18401->18294 18403 b6fb40 Netbios 18402->18403 18403->18398 18404 b6fb65 18403->18404 18405 b6edf0 95 API calls 18404->18405 18406 b6fba8 18405->18406 18407 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18406->18407 18408 b6fbc3 18407->18408 18408->18294 18410 b6eefa _memset 18409->18410 18411 b6edf0 95 API calls 18410->18411 18413 b6ef1e _memset _strncat 18411->18413 18412 b6edf0 95 API calls 18412->18413 18413->18412 18416 b6f031 _memset 18413->18416 18414 b6f05c 18415 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18414->18415 18417 b6f06f 18415->18417 18416->18414 18418 b6edf0 95 API calls 18416->18418 18417->18272 18421 b6fe60 18417->18421 18419 b6f056 18418->18419 18878 b7593a 18419->18878 18422 b6fe89 _memset 18421->18422 18423 b6eec0 120 API calls 18422->18423 18424 b6fe99 18423->18424 18424->18424 18425 b6fefd SHSetValueA 18424->18425 18426 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18425->18426 18427 b6ff2d 18426->18427 18427->18272 18429 b6edfa 18428->18429 18431 b6ee28 18429->18431 18432 b75675 18429->18432 18431->18318 18435 b755c2 18432->18435 18436 b755f2 18435->18436 18437 b755d2 18435->18437 18439 b7561e 18436->18439 18441 b75601 18436->18441 18438 b747a6 _memcpy_s 61 API calls 18437->18438 18440 b755d7 18438->18440 18450 b77db4 18439->18450 18443 b71323 _memcpy_s 6 API calls 18440->18443 18444 b747a6 _memcpy_s 61 API calls 18441->18444 18448 b755e7 18443->18448 18446 b75606 18444->18446 18447 b71323 _memcpy_s 6 API calls 18446->18447 18447->18448 18448->18431 18491 b71b27 18450->18491 18453 b77e1f 18454 b747a6 _memcpy_s 61 API calls 18453->18454 18455 b77e24 18454->18455 18457 b71323 _memcpy_s 6 API calls 18455->18457 18458 b77e36 18457->18458 18459 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18458->18459 18460 b7564d 18459->18460 18460->18448 18470 b77c50 18460->18470 18462 b807c4 93 API calls __output_l 18467 b77e60 __output_l __aulldvrm _strlen 18462->18467 18463 b7108d ___init_ctype 61 API calls 18463->18467 18464 b807f7 93 API calls _write_multi_char 18464->18467 18465 b8081d 93 API calls _write_string 18465->18467 18466 b74685 __malloc_crt 61 API calls 18466->18467 18467->18453 18467->18458 18467->18462 18467->18463 18467->18464 18467->18465 18467->18466 18468 b807a7 71 API calls __cftof 18467->18468 18469 b77212 6 API calls __decode_pointer 18467->18469 18505 b7b322 18467->18505 18468->18467 18469->18467 18471 b78c09 __fileno 61 API calls 18470->18471 18472 b77c60 18471->18472 18473 b77c82 18472->18473 18474 b77c6b 18472->18474 18476 b77c86 18473->18476 18483 b77c93 _printf 18473->18483 18475 b747a6 _memcpy_s 61 API calls 18474->18475 18486 b77c70 18475->18486 18477 b747a6 _memcpy_s 61 API calls 18476->18477 18477->18486 18478 b77cf4 18479 b77d83 18478->18479 18480 b77d03 18478->18480 18481 b79c26 __locking 93 API calls 18479->18481 18482 b77d1a 18480->18482 18487 b77d37 18480->18487 18481->18486 18552 b79c26 18482->18552 18483->18478 18483->18486 18488 b77ce9 18483->18488 18540 b805d7 18483->18540 18486->18448 18487->18486 18577 b80475 18487->18577 18488->18478 18549 b8058e 18488->18549 18492 b71b3a 18491->18492 18496 b71b87 18491->18496 18508 b7745e 18492->18508 18495 b71b67 18495->18496 18528 b7ae65 18495->18528 18496->18453 18496->18467 18499 b78c09 18496->18499 18500 b78c18 18499->18500 18502 b78c2d 18499->18502 18501 b747a6 _memcpy_s 61 API calls 18500->18501 18503 b78c1d 18501->18503 18502->18467 18504 b71323 _memcpy_s 6 API calls 18503->18504 18504->18502 18506 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18505->18506 18507 b7b335 18506->18507 18507->18467 18509 b773e5 __getptd_noexit 61 API calls 18508->18509 18510 b77466 18509->18510 18511 b77764 __amsg_exit 61 API calls 18510->18511 18512 b71b3f 18510->18512 18511->18512 18512->18495 18513 b72d57 18512->18513 18514 b72d63 ___BuildCatchObject 18513->18514 18515 b7745e __getptd 61 API calls 18514->18515 18516 b72d68 18515->18516 18517 b72d96 18516->18517 18519 b72d7a 18516->18519 18518 b76501 __lock 61 API calls 18517->18518 18520 b72d9d 18518->18520 18521 b7745e __getptd 61 API calls 18519->18521 18522 b72d19 _setlocale 69 API calls 18520->18522 18524 b72d7f 18521->18524 18523 b72db0 18522->18523 18525 b72dc1 _LocaleUpdate::_LocaleUpdate LeaveCriticalSection 18523->18525 18526 b72d8d ___BuildCatchObject 18524->18526 18527 b77764 __amsg_exit 61 API calls 18524->18527 18525->18524 18526->18495 18527->18526 18529 b7ae71 ___BuildCatchObject 18528->18529 18530 b7745e __getptd 61 API calls 18529->18530 18531 b7ae76 18530->18531 18532 b7ae88 18531->18532 18533 b76501 __lock 61 API calls 18531->18533 18534 b7ae96 ___BuildCatchObject 18532->18534 18536 b77764 __amsg_exit 61 API calls 18532->18536 18538 b7aea6 18533->18538 18534->18496 18535 b7aed6 18537 b7af00 _LocaleUpdate::_LocaleUpdate LeaveCriticalSection 18535->18537 18536->18534 18537->18532 18538->18535 18539 b7108d ___init_ctype 61 API calls 18538->18539 18539->18535 18541 b805f3 18540->18541 18542 b805e4 18540->18542 18545 b747a6 _memcpy_s 61 API calls 18541->18545 18547 b80617 18541->18547 18543 b747a6 _memcpy_s 61 API calls 18542->18543 18544 b805e9 18543->18544 18544->18488 18546 b80607 18545->18546 18548 b71323 _memcpy_s 6 API calls 18546->18548 18547->18488 18548->18547 18550 b74685 __malloc_crt 61 API calls 18549->18550 18551 b805a3 18550->18551 18551->18478 18553 b79c32 ___BuildCatchObject 18552->18553 18554 b79c55 18553->18554 18555 b79c3a 18553->18555 18557 b79c63 18554->18557 18560 b79ca4 18554->18560 18609 b747b9 18555->18609 18559 b747b9 __chsize_nolock 61 API calls 18557->18559 18562 b79c68 18559->18562 18612 b815b8 18560->18612 18561 b747a6 _memcpy_s 61 API calls 18570 b79c47 ___BuildCatchObject 18561->18570 18564 b747a6 _memcpy_s 61 API calls 18562->18564 18565 b79c6f 18564->18565 18567 b71323 _memcpy_s 6 API calls 18565->18567 18566 b79caa 18568 b79cb7 18566->18568 18569 b79ccd 18566->18569 18567->18570 18622 b794f3 18568->18622 18572 b747a6 _memcpy_s 61 API calls 18569->18572 18570->18486 18574 b79cd2 18572->18574 18573 b79cc5 18681 b79cf8 18573->18681 18575 b747b9 __chsize_nolock 61 API calls 18574->18575 18575->18573 18578 b80481 ___BuildCatchObject 18577->18578 18579 b804ae 18578->18579 18580 b80492 18578->18580 18581 b804bc 18579->18581 18584 b804dd 18579->18584 18582 b747b9 __chsize_nolock 61 API calls 18580->18582 18585 b747b9 __chsize_nolock 61 API calls 18581->18585 18583 b80497 18582->18583 18586 b747a6 _memcpy_s 61 API calls 18583->18586 18588 b804fd 18584->18588 18589 b80523 18584->18589 18587 b804c1 18585->18587 18590 b8049f ___BuildCatchObject 18586->18590 18592 b747a6 _memcpy_s 61 API calls 18587->18592 18593 b747b9 __chsize_nolock 61 API calls 18588->18593 18591 b815b8 ___lock_fhandle 62 API calls 18589->18591 18590->18486 18595 b80529 18591->18595 18596 b804c8 18592->18596 18594 b80502 18593->18594 18597 b747a6 _memcpy_s 61 API calls 18594->18597 18598 b80552 18595->18598 18599 b80536 18595->18599 18600 b71323 _memcpy_s 6 API calls 18596->18600 18601 b80509 18597->18601 18603 b747a6 _memcpy_s 61 API calls 18598->18603 18684 b803f0 18599->18684 18600->18590 18604 b71323 _memcpy_s 6 API calls 18601->18604 18605 b80557 18603->18605 18604->18590 18607 b747b9 __chsize_nolock 61 API calls 18605->18607 18606 b80547 18694 b80584 18606->18694 18607->18606 18610 b773e5 __getptd_noexit 61 API calls 18609->18610 18611 b747be 18610->18611 18611->18561 18613 b815c4 ___BuildCatchObject 18612->18613 18614 b8161f 18613->18614 18617 b76501 __lock 61 API calls 18613->18617 18615 b81641 ___BuildCatchObject 18614->18615 18616 b81624 EnterCriticalSection 18614->18616 18615->18566 18616->18615 18618 b815f0 18617->18618 18620 b801ac __alloc_osfhnd InitializeCriticalSectionAndSpinCount 18618->18620 18621 b81607 18618->18621 18619 b8164f ___lock_fhandle LeaveCriticalSection 18619->18614 18620->18621 18621->18619 18623 b79502 __write_nolock 18622->18623 18624 b79534 18623->18624 18625 b7955b 18623->18625 18654 b79529 18623->18654 18626 b747b9 __chsize_nolock 61 API calls 18624->18626 18629 b795c3 18625->18629 18630 b7959d 18625->18630 18628 b79539 18626->18628 18627 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18631 b79c24 18627->18631 18633 b747a6 _memcpy_s 61 API calls 18628->18633 18632 b795d7 18629->18632 18635 b803f0 __lseeki64_nolock 63 API calls 18629->18635 18634 b747b9 __chsize_nolock 61 API calls 18630->18634 18631->18573 18637 b805d7 __write_nolock 61 API calls 18632->18637 18636 b79540 18633->18636 18638 b795a2 18634->18638 18635->18632 18639 b71323 _memcpy_s 6 API calls 18636->18639 18640 b795e2 18637->18640 18641 b747a6 _memcpy_s 61 API calls 18638->18641 18639->18654 18642 b79888 18640->18642 18647 b7745e __getptd 61 API calls 18640->18647 18643 b795ab 18641->18643 18645 b79b57 WriteFile 18642->18645 18646 b79898 18642->18646 18644 b71323 _memcpy_s 6 API calls 18643->18644 18644->18654 18648 b79b8a GetLastError 18645->18648 18673 b7986a 18645->18673 18649 b79976 18646->18649 18658 b798ac 18646->18658 18650 b795fd GetConsoleMode 18647->18650 18648->18673 18651 b79985 18649->18651 18660 b79a56 18649->18660 18650->18642 18653 b79628 18650->18653 18652 b79bd5 18651->18652 18668 b799fa WriteFile 18651->18668 18651->18673 18652->18654 18656 b747a6 _memcpy_s 61 API calls 18652->18656 18653->18642 18655 b7963a GetConsoleCP 18653->18655 18654->18627 18655->18673 18679 b7965d 18655->18679 18659 b79bf8 18656->18659 18657 b79ba8 18662 b79bc7 18657->18662 18663 b79bb3 18657->18663 18658->18652 18664 b7991a WriteFile 18658->18664 18658->18673 18665 b747b9 __chsize_nolock 61 API calls 18659->18665 18660->18652 18661 b79abc WideCharToMultiByte 18660->18661 18667 b79af3 WriteFile 18660->18667 18660->18673 18661->18648 18661->18667 18669 b747cc __dosmaperr 61 API calls 18662->18669 18666 b747a6 _memcpy_s 61 API calls 18663->18666 18664->18648 18664->18658 18665->18654 18671 b79bb8 18666->18671 18667->18660 18670 b79b2a GetLastError 18667->18670 18668->18648 18668->18651 18669->18654 18670->18660 18674 b747b9 __chsize_nolock 61 API calls 18671->18674 18672 b7b35a __write_nolock 69 API calls 18672->18679 18673->18652 18673->18654 18673->18657 18674->18654 18675 b79709 WideCharToMultiByte 18675->18673 18677 b7973a WriteFile 18675->18677 18676 b8267f 71 API calls __fassign 18676->18679 18677->18648 18677->18679 18678 b824a3 11 API calls __putwch_nolock 18678->18679 18679->18648 18679->18672 18679->18673 18679->18675 18679->18676 18679->18678 18680 b7978e WriteFile 18679->18680 18680->18648 18680->18679 18682 b81658 __unlock_fhandle LeaveCriticalSection 18681->18682 18683 b79d00 18682->18683 18683->18570 18685 b81541 __chsize_nolock 61 API calls 18684->18685 18686 b8040e 18685->18686 18687 b80416 18686->18687 18688 b80427 SetFilePointer 18686->18688 18689 b747a6 _memcpy_s 61 API calls 18687->18689 18690 b8043f GetLastError 18688->18690 18691 b8041b 18688->18691 18689->18691 18690->18691 18692 b80449 18690->18692 18691->18606 18693 b747cc __dosmaperr 61 API calls 18692->18693 18693->18691 18695 b81658 __unlock_fhandle LeaveCriticalSection 18694->18695 18696 b8058c 18695->18696 18696->18590 18697->18336 18699 b70c33 18698->18699 18703 b70b74 18698->18703 18699->18358 18702 b70c0f 18702->18699 18705 b720a8 83 API calls 18702->18705 18703->18699 18703->18702 18706 b71cc3 18703->18706 18710 b72024 18703->18710 18715 b720a8 18703->18715 18705->18702 18707 b71ce1 18706->18707 18709 b71cd1 18706->18709 18720 b71bae 18707->18720 18709->18703 18711 b72044 18710->18711 18712 b72032 18710->18712 18855 b71fd3 18711->18855 18712->18703 18716 b720b6 18715->18716 18717 b720ca 18715->18717 18716->18703 18860 b72052 18717->18860 18721 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18720->18721 18722 b71bc3 18721->18722 18723 b71c23 18722->18723 18724 b71bcf 18722->18724 18725 b71c48 18723->18725 18726 b7b322 __isleadbyte_l 69 API calls 18723->18726 18731 b71be7 18724->18731 18732 b7b36d 18724->18732 18727 b747a6 _memcpy_s 61 API calls 18725->18727 18729 b71c4e 18725->18729 18726->18725 18727->18729 18739 b73eb8 18729->18739 18731->18709 18733 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18732->18733 18734 b7b381 18733->18734 18735 b7b322 __isleadbyte_l 69 API calls 18734->18735 18738 b7b38e 18734->18738 18736 b7b3b6 18735->18736 18744 b7f6ac 18736->18744 18738->18731 18740 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18739->18740 18741 b73ecb 18740->18741 18773 b73b13 18741->18773 18745 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18744->18745 18746 b7f6bf 18745->18746 18749 b7f4f2 18746->18749 18750 b7f513 GetStringTypeW 18749->18750 18751 b7f53e 18749->18751 18752 b7f533 GetLastError 18750->18752 18755 b7f52b 18750->18755 18753 b7f625 18751->18753 18751->18755 18752->18751 18756 b7f730 ___ansicp 77 API calls 18753->18756 18754 b7f577 MultiByteToWideChar 18761 b7f5a4 18754->18761 18772 b7f61f 18754->18772 18755->18754 18755->18772 18758 b7f649 18756->18758 18757 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18759 b7f6aa 18757->18759 18760 b7f676 GetStringTypeA 18758->18760 18763 b7f779 ___convertcp 68 API calls 18758->18763 18758->18772 18759->18738 18765 b7f691 18760->18765 18760->18772 18762 b713a8 _malloc 61 API calls 18761->18762 18766 b7f5b9 _memset _strlwr_s_l_stat 18761->18766 18762->18766 18767 b7f66a 18763->18767 18764 b7f5f2 MultiByteToWideChar 18768 b7f619 18764->18768 18769 b7f608 GetStringTypeW 18764->18769 18770 b7108d ___init_ctype 61 API calls 18765->18770 18766->18764 18766->18772 18767->18760 18767->18772 18771 b73af3 __freea 61 API calls 18768->18771 18769->18768 18770->18772 18771->18772 18772->18757 18774 b73b34 LCMapStringW 18773->18774 18777 b73b4f 18773->18777 18775 b73b57 GetLastError 18774->18775 18774->18777 18775->18777 18776 b73d4d 18824 b7f730 GetLocaleInfoA 18776->18824 18777->18776 18778 b73ba9 18777->18778 18780 b73bc2 MultiByteToWideChar 18778->18780 18802 b73d44 18778->18802 18786 b73bef 18780->18786 18780->18802 18782 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18783 b73eb6 18782->18783 18783->18731 18784 b73d8e 18830 b7f779 18784->18830 18785 b73e69 LCMapStringA 18819 b73dc5 18785->18819 18790 b713a8 _malloc 61 API calls 18786->18790 18797 b73c08 _strlwr_s_l_stat 18786->18797 18788 b73c40 MultiByteToWideChar 18792 b73c59 LCMapStringW 18788->18792 18814 b73d3b 18788->18814 18789 b73e90 18800 b7108d ___init_ctype 61 API calls 18789->18800 18789->18802 18790->18797 18796 b73c7a 18792->18796 18792->18814 18793 b7108d ___init_ctype 61 API calls 18793->18789 18794 b73daa LCMapStringA 18805 b73dcc 18794->18805 18794->18819 18795 b73af3 __freea 61 API calls 18795->18802 18798 b73c83 18796->18798 18804 b73cac 18796->18804 18797->18788 18797->18802 18801 b73c95 LCMapStringW 18798->18801 18798->18814 18799 b73cc7 _strlwr_s_l_stat 18803 b73cfb LCMapStringW 18799->18803 18799->18814 18800->18802 18801->18814 18802->18782 18806 b73d35 18803->18806 18807 b73d13 WideCharToMultiByte 18803->18807 18804->18799 18810 b713a8 _malloc 61 API calls 18804->18810 18808 b713a8 _malloc 61 API calls 18805->18808 18809 b73ddd _memset _strlwr_s_l_stat 18805->18809 18820 b73af3 18806->18820 18807->18806 18808->18809 18812 b73e1b LCMapStringA 18809->18812 18809->18819 18810->18799 18815 b73e37 18812->18815 18816 b73e3b 18812->18816 18814->18795 18818 b73af3 __freea 61 API calls 18815->18818 18817 b7f779 ___convertcp 68 API calls 18816->18817 18817->18815 18818->18819 18819->18789 18819->18793 18821 b73b10 18820->18821 18822 b73aff 18820->18822 18821->18814 18822->18821 18823 b7108d ___init_ctype 61 API calls 18822->18823 18823->18821 18825 b7f763 18824->18825 18826 b7f75e 18824->18826 18827 b71b06 ___ansicp 82 API calls 18825->18827 18828 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18826->18828 18827->18826 18829 b73d75 18828->18829 18829->18784 18829->18785 18829->18802 18831 b7f7b9 GetCPInfo 18830->18831 18847 b7f843 18830->18847 18832 b7f7d0 18831->18832 18833 b7f82e MultiByteToWideChar 18831->18833 18832->18833 18835 b7f7d6 GetCPInfo 18832->18835 18838 b7f7e9 _strlen 18833->18838 18833->18847 18834 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18837 b73da0 18834->18837 18835->18833 18836 b7f7e3 18835->18836 18836->18833 18836->18838 18837->18794 18837->18802 18839 b713a8 _malloc 61 API calls 18838->18839 18841 b7f81b _memset _strlwr_s_l_stat 18838->18841 18839->18841 18840 b7f878 MultiByteToWideChar 18842 b7f890 18840->18842 18843 b7f8af 18840->18843 18841->18840 18841->18847 18845 b7f897 WideCharToMultiByte 18842->18845 18846 b7f8b4 18842->18846 18844 b73af3 __freea 61 API calls 18843->18844 18844->18847 18845->18843 18848 b7f8d3 18846->18848 18849 b7f8bf WideCharToMultiByte 18846->18849 18847->18834 18850 b746ca __calloc_crt 61 API calls 18848->18850 18849->18843 18849->18848 18851 b7f8db 18850->18851 18851->18843 18852 b7f8e4 WideCharToMultiByte 18851->18852 18852->18843 18853 b7f8f6 18852->18853 18854 b7108d ___init_ctype 61 API calls 18853->18854 18854->18843 18856 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18855->18856 18857 b71fe6 18856->18857 18858 b72000 18857->18858 18859 b7b36d __isctype_l 83 API calls 18857->18859 18858->18703 18859->18858 18861 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18860->18861 18862 b72065 18861->18862 18863 b7b36d __isctype_l 83 API calls 18862->18863 18864 b72082 18862->18864 18863->18864 18864->18703 18866 b6edf0 95 API calls 18865->18866 18867 b6f775 CreateFileA 18866->18867 18868 b6f7b4 DeviceIoControl 18867->18868 18869 b6f79b 18867->18869 18871 b6f82c CloseHandle 18868->18871 18874 b6f7e7 18868->18874 18870 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18869->18870 18873 b6f7ad 18870->18873 18872 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18871->18872 18875 b6f845 18872->18875 18873->18393 18874->18871 18876 b6edf0 95 API calls 18874->18876 18875->18393 18877 b6f824 18876->18877 18877->18871 18879 b7598b 18878->18879 18880 b7594a 18878->18880 18886 b75906 18879->18886 18882 b747a6 _memcpy_s 61 API calls 18880->18882 18884 b75966 18880->18884 18883 b75956 18882->18883 18885 b71323 _memcpy_s 6 API calls 18883->18885 18884->18414 18885->18884 18887 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18886->18887 18888 b75919 18887->18888 18891 b75783 18888->18891 18892 b757a1 18891->18892 18893 b757bd _strnlen 18891->18893 18894 b747a6 _memcpy_s 61 API calls 18892->18894 18893->18892 18896 b757d1 18893->18896 18895 b757a6 18894->18895 18897 b71323 _memcpy_s 6 API calls 18895->18897 18898 b73eb8 ___crtLCMapStringA 94 API calls 18896->18898 18900 b757b5 18896->18900 18897->18900 18899 b75814 18898->18899 18902 b75837 18899->18902 18903 b75820 18899->18903 18901 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18900->18901 18906 b75904 18901->18906 18905 b7583c 18902->18905 18912 b7584a 18902->18912 18904 b747a6 _memcpy_s 61 API calls 18903->18904 18907 b75825 18904->18907 18908 b747a6 _memcpy_s 61 API calls 18905->18908 18906->18884 18909 b747a6 _memcpy_s 61 API calls 18907->18909 18908->18895 18909->18900 18910 b7589b 18914 b747a6 _memcpy_s 61 API calls 18910->18914 18911 b758a8 18915 b73eb8 ___crtLCMapStringA 94 API calls 18911->18915 18913 b713a8 _malloc 61 API calls 18912->18913 18917 b75864 _strlwr_s_l_stat 18912->18917 18913->18917 18914->18907 18916 b758c3 18915->18916 18918 b758dd 18916->18918 18919 b758ca 18916->18919 18917->18910 18917->18911 18920 b747a6 _memcpy_s 61 API calls 18918->18920 18921 b75f82 _strcpy_s 61 API calls 18919->18921 18922 b758d6 18920->18922 18921->18922 18923 b73af3 __freea 61 API calls 18922->18923 18923->18900 18927 b75692 18924->18927 18928 b756c2 18927->18928 18929 b756a2 18927->18929 18931 b756ee 18928->18931 18933 b756d1 18928->18933 18930 b747a6 _memcpy_s 61 API calls 18929->18930 18932 b756a7 18930->18932 18944 b79e4d 18931->18944 18934 b71323 _memcpy_s 6 API calls 18932->18934 18935 b747a6 _memcpy_s 61 API calls 18933->18935 18940 b756b7 18934->18940 18937 b756d6 18935->18937 18939 b71323 _memcpy_s 6 API calls 18937->18939 18939->18940 18940->18303 18941 b75731 18941->18940 18943 b77c50 __flsbuf 93 API calls 18941->18943 18942 b77c50 __flsbuf 93 API calls 18942->18941 18943->18940 18945 b71b27 _LocaleUpdate::_LocaleUpdate 69 API calls 18944->18945 18946 b79eb4 18945->18946 18947 b79ebc 18946->18947 18958 b79ef3 __output_l __aulldvrm _strlen 18946->18958 18948 b747a6 _memcpy_s 61 API calls 18947->18948 18949 b79ec1 18948->18949 18950 b71323 _memcpy_s 6 API calls 18949->18950 18952 b79ed1 18950->18952 18951 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18953 b75723 18951->18953 18952->18951 18953->18940 18953->18941 18953->18942 18954 b7108d ___init_ctype 61 API calls 18954->18958 18955 b79dfb 95 API calls _write_string 18955->18958 18956 b7b322 __isleadbyte_l 69 API calls 18956->18958 18957 b82568 71 API calls __fassign 18957->18958 18958->18952 18958->18954 18958->18955 18958->18956 18958->18957 18959 b74685 __malloc_crt 61 API calls 18958->18959 18960 b7a983 18958->18960 18962 b77212 6 API calls __decode_pointer 18958->18962 18963 b79da5 95 API calls __woutput_l 18958->18963 18964 b79dd4 95 API calls _write_multi_char 18958->18964 18959->18958 18961 b747a6 _memcpy_s 61 API calls 18960->18961 18961->18949 18962->18958 18963->18958 18964->18958 18966 b64db0 18965->18966 18967 b64dab 18965->18967 18969 b64dcc 18966->18969 18981 b65280 18966->18981 18995 b6e35d 18967->18995 18969->17977 18971 b64dc2 18971->17977 18975 b70f0f _memset 18972->18975 18977 b70f0b _memcpy_s 18972->18977 18973 b70f14 18974 b747a6 _memcpy_s 61 API calls 18973->18974 18976 b70f19 18974->18976 18975->18973 18975->18977 18978 b70f5e 18975->18978 18979 b71323 _memcpy_s 6 API calls 18976->18979 18977->17975 18978->18977 18980 b747a6 _memcpy_s 61 API calls 18978->18980 18979->18977 18980->18976 18982 b652be 18981->18982 18983 b652f0 18982->18983 18984 b6530e 18982->18984 19003 b71187 18983->19003 19015 b70d72 18984->19015 18987 b652fb 18992 b6537d ctype 18987->18992 18994 b70efb _memcpy_s 61 API calls 18987->18994 18990 b65332 19024 b65930 18990->19024 18992->18971 18994->18992 18996 b6e369 __EH_prolog3 18995->18996 18997 b63bd0 std::_String_base::_Xlen 73 API calls 18996->18997 18998 b6e376 18997->18998 19043 b61130 18998->19043 19001 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19002 b6e394 19001->19002 19005 b71191 19003->19005 19004 b713a8 _malloc 61 API calls 19004->19005 19005->19004 19006 b711ab 19005->19006 19007 b77167 _realloc 6 API calls 19005->19007 19010 b711ad std::bad_alloc::bad_alloc 19005->19010 19006->18987 19007->19005 19008 b711d3 19034 b62e10 19008->19034 19010->19008 19012 b71a1c __cinit 72 API calls 19010->19012 19012->19008 19013 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19014 b711eb 19013->19014 19016 b70d8b _strlen 19015->19016 19017 b6531d 19015->19017 19018 b713a8 _malloc 61 API calls 19016->19018 19021 b7249b 19017->19021 19019 b70d9a 19018->19019 19019->19017 19020 b75f82 _strcpy_s 61 API calls 19019->19020 19020->19017 19022 b724c4 19021->19022 19023 b724d0 KiUserExceptionDispatcher 19021->19023 19022->19023 19023->18990 19025 b65937 19024->19025 19026 b65949 19024->19026 19028 b71187 std::_Mutex::_Mutex 73 API calls 19025->19028 19026->19025 19027 b65955 19026->19027 19029 b70d72 std::exception::exception 61 API calls 19027->19029 19030 b65347 19028->19030 19031 b6596a 19029->19031 19030->18971 19032 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19031->19032 19033 b65981 19032->19033 19037 b70de2 19034->19037 19038 b70e02 _strlen 19037->19038 19039 b62e1d 19037->19039 19038->19039 19040 b713a8 _malloc 61 API calls 19038->19040 19039->19013 19041 b70e15 19040->19041 19041->19039 19042 b75f82 _strcpy_s 61 API calls 19041->19042 19042->19039 19046 b610c0 19043->19046 19047 b610ed std::_String_base::_Xlen 19046->19047 19050 b64570 19047->19050 19049 b61116 19049->19001 19051 b64583 19050->19051 19052 b64588 19050->19052 19066 b6e395 19051->19066 19054 b645ba 19052->19054 19055 b6459b 19052->19055 19056 b645c4 19054->19056 19059 b6e35d std::_String_base::_Xlen 73 API calls 19054->19059 19074 b64a30 19055->19074 19064 b645d7 19056->19064 19080 b65110 19056->19080 19059->19056 19060 b64a30 std::_String_base::_Xlen 73 API calls 19063 b645b1 19060->19063 19062 b645ea 19062->19049 19063->19049 19064->19062 19065 b70efb _memcpy_s 61 API calls 19064->19065 19065->19062 19067 b6e3a1 __EH_prolog3 19066->19067 19068 b63bd0 std::_String_base::_Xlen 73 API calls 19067->19068 19069 b6e3ae 19068->19069 19093 b61150 19069->19093 19072 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19073 b6e3cc 19072->19073 19075 b64a3e 19074->19075 19078 b64a43 19074->19078 19076 b6e395 std::_String_base::_Xlen 73 API calls 19075->19076 19076->19078 19077 b645a7 19077->19060 19078->19077 19096 b70f78 19078->19096 19081 b6514d 19080->19081 19082 b6517f 19081->19082 19083 b6519b 19081->19083 19084 b71187 std::_Mutex::_Mutex 73 API calls 19082->19084 19085 b70d72 std::exception::exception 61 API calls 19083->19085 19090 b65187 19084->19090 19086 b651aa 19085->19086 19087 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19086->19087 19088 b651bf 19087->19088 19112 b658d0 19088->19112 19090->19064 19091 b65209 ctype 19090->19091 19092 b70efb _memcpy_s 61 API calls 19090->19092 19091->19064 19092->19091 19094 b610c0 std::_String_base::_Xlen 73 API calls 19093->19094 19095 b6115d 19094->19095 19095->19072 19097 b70fa1 19096->19097 19098 b70f88 19096->19098 19097->19077 19099 b70f8d 19098->19099 19101 b70fad 19098->19101 19100 b747a6 _memcpy_s 61 API calls 19099->19100 19102 b70f92 19100->19102 19103 b70fb2 19101->19103 19104 b70fc0 19101->19104 19107 b71323 _memcpy_s 6 API calls 19102->19107 19106 b747a6 _memcpy_s 61 API calls 19103->19106 19108 b75ff0 19104->19108 19106->19102 19107->19097 19109 b76008 19108->19109 19110 b7602f __VEC_memcpy 19109->19110 19111 b76037 19109->19111 19110->19111 19111->19097 19113 b658ec 19112->19113 19114 b658db 19112->19114 19113->19114 19115 b658f8 19113->19115 19116 b71187 std::_Mutex::_Mutex 73 API calls 19114->19116 19117 b70d72 std::exception::exception 61 API calls 19115->19117 19119 b658e3 19116->19119 19118 b6590e 19117->19118 19120 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19118->19120 19119->19090 19121 b65925 19120->19121 19123 b62e3a _memset __write_nolock 19122->19123 19124 b62f19 19123->19124 19126 b62e7a GetFileVersionInfoSizeW 19123->19126 19125 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19124->19125 19127 b62f29 19125->19127 19126->19124 19128 b62e8d 19126->19128 19127->17992 19128->19124 19129 b62e98 GetFileVersionInfoW 19128->19129 19129->19124 19130 b62eaa VerQueryValueW 19129->19130 19130->19124 19131 b62ec7 _memset 19130->19131 19140 b71a33 19131->19140 19134 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19135 b62f12 19134->19135 19135->17992 19137 b63da6 19136->19137 19137->19137 19138 b64c60 73 API calls 19137->19138 19139 b63031 19138->19139 19139->17996 19141 b71a63 19140->19141 19142 b71a43 19140->19142 19144 b71a8f 19141->19144 19146 b71a72 19141->19146 19143 b747a6 _memcpy_s 61 API calls 19142->19143 19145 b71a48 19143->19145 19149 b79e4d __woutput_l 95 API calls 19144->19149 19147 b71323 _memcpy_s 6 API calls 19145->19147 19148 b747a6 _memcpy_s 61 API calls 19146->19148 19153 b62efc 19147->19153 19150 b71a77 19148->19150 19151 b71ac3 19149->19151 19152 b71323 _memcpy_s 6 API calls 19150->19152 19151->19153 19154 b71ad1 19151->19154 19155 b77c50 __flsbuf 93 API calls 19151->19155 19152->19153 19153->19134 19154->19153 19156 b77c50 __flsbuf 93 API calls 19154->19156 19155->19154 19156->19153 19158 b64d1b 19157->19158 19160 b64d20 19157->19160 19159 b6e395 std::_String_base::_Xlen 73 API calls 19158->19159 19159->19160 19161 b70f78 _memmove_s 62 API calls 19160->19161 19162 b64784 19160->19162 19161->19162 19162->18029 19164 b69094 19163->19164 19167 b69052 19163->19167 19165 b690ac 19164->19165 19166 b6e35d std::_String_base::_Xlen 73 API calls 19164->19166 19168 b690c3 19165->19168 19169 b6e35d std::_String_base::_Xlen 73 API calls 19165->19169 19172 b690ed 19165->19172 19166->19165 19167->19164 19171 b6907b 19167->19171 19170 b65110 std::_Locinfo::_Locinfo_ctor 73 API calls 19168->19170 19174 b690d6 19168->19174 19169->19168 19170->19174 19177 b6a0c0 19171->19177 19172->18037 19174->19172 19176 b70efb _memcpy_s 61 API calls 19174->19176 19176->19172 19178 b6a0d7 19177->19178 19179 b6a0d2 19177->19179 19181 b6e35d std::_String_base::_Xlen 73 API calls 19178->19181 19182 b6a0fa 19178->19182 19180 b6e395 std::_String_base::_Xlen 73 API calls 19179->19180 19180->19178 19181->19182 19183 b6a111 19182->19183 19184 b6e35d std::_String_base::_Xlen 73 API calls 19182->19184 19186 b6908d 19182->19186 19185 b65110 std::_Locinfo::_Locinfo_ctor 73 API calls 19183->19185 19187 b6a124 19183->19187 19184->19183 19185->19187 19186->18037 19187->19186 19188 b70efb _memcpy_s 61 API calls 19187->19188 19188->19186 19190 b71187 std::_Mutex::_Mutex 73 API calls 19189->19190 19191 b670e7 19190->19191 19192 b64950 19191->19192 19193 b649a3 19192->19193 19198 b6495d 19192->19198 19194 b649b1 19193->19194 19195 b6e35d std::_String_base::_Xlen 73 API calls 19193->19195 19196 b649c4 19194->19196 19197 b65110 std::_Locinfo::_Locinfo_ctor 73 API calls 19194->19197 19195->19194 19199 b649dc 19196->19199 19201 b70efb _memcpy_s 61 API calls 19196->19201 19197->19196 19198->19193 19200 b64986 19198->19200 19199->18053 19202 b64570 std::_String_base::_Xlen 73 API calls 19200->19202 19201->19199 19203 b6499d 19202->19203 19203->18053 19205 b6878a 19204->19205 19208 b6878f 19204->19208 19206 b71349 6 API calls 19205->19206 19206->19208 19207 b6879e 19212 b693f0 19207->19212 19208->19207 19209 b71349 6 API calls 19208->19209 19209->19207 19213 b693fc 19212->19213 19214 b71349 6 API calls 19213->19214 19215 b6940f 19213->19215 19214->19215 19216 b6942d 19215->19216 19217 b71349 6 API calls 19215->19217 19218 b69442 19216->19218 19219 b71349 6 API calls 19216->19219 19217->19216 19220 b63246 19218->19220 19221 b70f78 _memmove_s 62 API calls 19218->19221 19219->19218 19220->18056 19221->19220 19223 b66bc3 MultiByteToWideChar 19222->19223 19224 b66bbf 19222->19224 19225 b66bd9 19223->19225 19227 b66c2b 19223->19227 19224->19223 19226 b64750 73 API calls 19225->19226 19230 b66bf3 ctype 19226->19230 19228 b66c5c MultiByteToWideChar 19227->19228 19235 b66c92 19227->19235 19231 b66c77 19228->19231 19229 b64750 73 API calls 19229->19230 19232 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19230->19232 19231->19231 19234 b64b80 73 API calls 19231->19234 19233 b66d0d 19232->19233 19233->18062 19297 b680e0 19233->19297 19234->19235 19235->19229 19237 b66ed8 _memset __write_nolock 19236->19237 19238 b66fae InternetCrackUrlW 19237->19238 19239 b66fe2 19238->19239 19240 b66fd8 19238->19240 19242 b64c60 73 API calls 19239->19242 19241 b71d4a _printf 97 API calls 19240->19241 19241->19239 19243 b6700b 19242->19243 19244 b64c60 73 API calls 19243->19244 19247 b6703e 19244->19247 19245 b67067 19246 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19245->19246 19248 b67089 19246->19248 19247->19245 19249 b64b80 73 API calls 19247->19249 19250 b67800 InternetOpenW 19248->19250 19249->19245 19251 b672ad 19250->19251 19251->18074 19251->18075 19253 b678e6 InternetConnectW 19252->19253 19254 b678de 19252->19254 19255 b672f4 19253->19255 19254->19253 19255->18080 19255->18081 19257 b67997 HttpOpenRequestW 19256->19257 19258 b6798f 19256->19258 19259 b67336 19257->19259 19258->19257 19259->18086 19259->18087 19261 b6737b 19260->19261 19261->18092 19261->18093 19263 b673ac 19262->19263 19263->18098 19263->18101 19397 b69520 19264->19397 19269 b6b6c0 19270 b6b700 19269->19270 19652 b69710 19270->19652 19272 b6b80c 19274 b6b824 19272->19274 19658 b6a200 19272->19658 19273 b66920 73 API calls 19273->19272 19276 b673dc 19274->19276 19662 b6eb53 19274->19662 19279 b68180 19276->19279 19280 b69710 74 API calls 19279->19280 19281 b681be 19280->19281 19282 b6821e 19281->19282 19283 b66a50 2 API calls 19281->19283 19298 b68133 19297->19298 19299 b68121 InternetCloseHandle 19297->19299 19298->18062 19299->19298 19744 b67b60 HttpQueryInfoW 19300->19744 19303 b64750 73 API calls 19304 b67d34 19303->19304 19306 b66d20 75 API calls 19304->19306 19309 b67d3b ctype 19306->19309 19307 b67c90 19311 b67b60 HttpQueryInfoW 19307->19311 19313 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19309->19313 19310 b71349 6 API calls 19310->19307 19312 b67ca2 19311->19312 19314 b67cb6 19312->19314 19316 b71349 6 API calls 19312->19316 19315 b67489 19313->19315 19317 b64c60 73 API calls 19314->19317 19315->18112 19316->19314 19318 b67cd9 ctype 19317->19318 19318->19303 19320 b67b60 HttpQueryInfoW 19319->19320 19321 b67e00 19320->19321 19322 b67fc4 ctype 19321->19322 19324 b68640 74 API calls 19321->19324 19323 b70d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19322->19323 19325 b68058 19323->19325 19326 b67e50 19324->19326 19325->18140 19327 b67e67 19326->19327 19329 b71349 6 API calls 19326->19329 19328 b67b60 HttpQueryInfoW 19327->19328 19330 b67e7b 19328->19330 19329->19327 19331 b67e8f 19330->19331 19332 b71349 6 API calls 19330->19332 19333 b64c60 73 API calls 19331->19333 19332->19331 19334 b67eb9 19333->19334 19335 b64750 73 API calls 19334->19335 19336 b67ee0 19335->19336 19337 b66d20 75 API calls 19336->19337 19338 b67ee9 19337->19338 19338->19322 19768 b68150 19338->19768 19341 b64570 std::_String_base::_Xlen 73 API calls 19342 b67f4e ctype 19341->19342 19342->19322 19343 b68150 73 API calls 19342->19343 19344 b67f8e 19343->19344 19345 b64570 std::_String_base::_Xlen 73 API calls 19344->19345 19346 b67fa3 19345->19346 19349 b680b7 19348->19349 19349->18151 19352 b68721 19350->19352 19351 b68735 19351->18149 19352->19351 19353 b6874b 19352->19353 19354 b71349 6 API calls 19352->19354 19771 b69340 19353->19771 19354->19353 19358 b71d56 ___BuildCatchObject 19357->19358 19359 b71d64 19358->19359 19360 b71d81 _printf 19358->19360 19361 b747a6 _memcpy_s 61 API calls 19359->19361 19804 b78f17 19360->19804 19362 b71d69 19361->19362 19364 b71323 _memcpy_s 6 API calls 19362->19364 19366 b71d79 ___BuildCatchObject 19364->19366 19365 b71d93 _printf 19809 b7b5b3 19365->19809 19366->18151 19368 b71da5 _printf 19369 b77db4 __output_l 95 API calls 19368->19369 19370 b71dbd _printf 19369->19370 19375 b69491 19374->19375 19376 b6948c 19374->19376 19378 b694a4 19375->19378 19379 b71349 6 API calls 19375->19379 19377 b71349 6 API calls 19376->19377 19377->19375 19380 b693f0 62 API calls 19378->19380 19379->19378 19381 b694b7 19380->19381 19382 b694c4 19381->19382 19383 b71349 6 API calls 19381->19383 19384 b6a430 74 API calls 19382->19384 19383->19382 19385 b694d8 19384->19385 19385->18151 19387 b686e4 19386->19387 19388 b686df 19386->19388 19387->18151 19389 b71349 6 API calls 19388->19389 19389->19387 19836 b6bfe0 19390->19836 19392 b6b91b 19392->18151 19394 b64660 19393->19394 19394->19394 19395 b64950 std::_Locinfo::_Locinfo_ctor 73 API calls 19394->19395 19396 b64670 19395->19396 19396->17371 19411 b6a2a0 19397->19411 19400 b6a330 19646 b6eb19 19400->19646 19403 b71187 std::_Mutex::_Mutex 73 API calls 19404 b6a375 19403->19404 19405 b6e6d5 std::locale::_Init 77 API calls 19404->19405 19410 b673c7 19404->19410 19406 b6a383 19405->19406 19407 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19406->19407 19408 b6a397 19407->19408 19409 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19408->19409 19409->19410 19410->19269 19418 b66a80 19411->19418 19413 b6a2eb 19430 b6b4c0 19413->19430 19416 b6881a 19416->19400 19419 b66920 73 API calls 19418->19419 19420 b66ab1 19419->19420 19421 b71187 std::_Mutex::_Mutex 73 API calls 19420->19421 19422 b66ab8 19421->19422 19423 b66af8 19422->19423 19461 b6e6d5 19422->19461 19423->19413 19425 b66ac6 19477 b6e427 19425->19477 19429 b66aee 19429->19413 19539 b66a50 19430->19539 19435 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19436 b6b51d 19435->19436 19437 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19436->19437 19438 b6a2fb 19437->19438 19438->19416 19439 b66920 19438->19439 19440 b66963 19439->19440 19441 b66a39 19439->19441 19442 b66972 19440->19442 19443 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19440->19443 19441->19416 19444 b669b6 19442->19444 19445 b63bd0 std::_String_base::_Xlen 73 API calls 19442->19445 19443->19442 19446 b669fa 19444->19446 19449 b63bd0 std::_String_base::_Xlen 73 API calls 19444->19449 19448 b66985 19445->19448 19447 b63bd0 std::_String_base::_Xlen 73 API calls 19446->19447 19450 b66a08 19447->19450 19642 b661f0 19448->19642 19452 b669c9 19449->19452 19453 b661f0 73 API calls 19450->19453 19455 b661f0 73 API calls 19452->19455 19456 b66a22 19453->19456 19458 b669e3 19455->19458 19460 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19456->19460 19457 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19457->19444 19459 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19458->19459 19459->19446 19460->19441 19462 b6e6e1 __EH_prolog3 19461->19462 19463 b6e767 std::locale::_Locimp::~_Locimp 19462->19463 19464 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19462->19464 19463->19425 19465 b6e6f5 19464->19465 19466 b71187 std::_Mutex::_Mutex 73 API calls 19465->19466 19476 b6e751 19465->19476 19468 b6e70a 19466->19468 19467 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19467->19463 19469 b6e71e 19468->19469 19485 b6e62e 19468->19485 19489 b6e509 19469->19489 19473 b64650 std::_Locinfo::_Locinfo_ctor 73 API calls 19474 b6e744 19473->19474 19493 b664b0 19474->19493 19476->19467 19478 b66ad9 19477->19478 19479 b6e439 19477->19479 19481 b6e44f 19478->19481 19537 b6eb81 EnterCriticalSection 19479->19537 19482 b6e456 19481->19482 19483 b6e464 19481->19483 19538 b6eb91 LeaveCriticalSection 19482->19538 19483->19429 19486 b6e63a __EH_prolog3 19485->19486 19487 b63bd0 std::_String_base::_Xlen 73 API calls 19486->19487 19488 b6e66d std::locale::_Locimp::~_Locimp 19487->19488 19488->19469 19490 b6e517 19489->19490 19491 b6e528 19489->19491 19498 b6eba1 19490->19498 19491->19473 19494 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19493->19494 19495 b664bf 19494->19495 19496 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19495->19496 19497 b664d4 19496->19497 19497->19476 19499 b6ebaf 19498->19499 19499->19491 19500 b72970 19499->19500 19501 b77a6c __NMSG_WRITE 61 API calls 19499->19501 19510 b7c851 19500->19510 19501->19500 19503 b72981 _memset 19506 b72a59 19503->19506 19508 b72a19 SetUnhandledExceptionFilter UnhandledExceptionFilter 19503->19508 19534 b779ea 19506->19534 19508->19506 19511 b77212 __decode_pointer 6 API calls 19510->19511 19512 b72976 19511->19512 19512->19503 19513 b7c85e 19512->19513 19516 b7c86a ___BuildCatchObject 19513->19516 19514 b7c8c6 19517 b7c8a7 19514->19517 19519 b7c8d5 19514->19519 19515 b7c891 19518 b773e5 __getptd_noexit 61 API calls 19515->19518 19516->19514 19516->19515 19516->19517 19522 b7c88d 19516->19522 19520 b77212 __decode_pointer 6 API calls 19517->19520 19523 b7c896 _siglookup 19518->19523 19521 b747a6 _memcpy_s 61 API calls 19519->19521 19520->19523 19524 b7c8da 19521->19524 19522->19515 19522->19519 19526 b7c93c 19523->19526 19527 b779ea _abort 61 API calls 19523->19527 19528 b7c89f ___BuildCatchObject 19523->19528 19525 b71323 _memcpy_s 6 API calls 19524->19525 19525->19528 19529 b76501 __lock 61 API calls 19526->19529 19530 b7c947 19526->19530 19527->19526 19528->19503 19529->19530 19531 b77209 _raise 6 API calls 19530->19531 19532 b7c97c 19530->19532 19531->19532 19533 b7c9d2 _raise LeaveCriticalSection 19532->19533 19533->19528 19535 b778a8 _doexit 61 API calls 19534->19535 19536 b72a60 19535->19536 19537->19478 19538->19483 19540 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19539->19540 19541 b66a64 19540->19541 19542 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19541->19542 19543 b66a79 19542->19543 19544 b6b570 19543->19544 19545 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19544->19545 19546 b6b5a0 19545->19546 19547 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19546->19547 19549 b6b5e8 19546->19549 19548 b6b5c6 19547->19548 19551 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19548->19551 19550 b6b625 19549->19550 19565 b665f0 19549->19565 19552 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19550->19552 19551->19549 19554 b6b500 19552->19554 19554->19435 19554->19438 19555 b6b634 19556 b6b659 19555->19556 19577 b70e62 19555->19577 19558 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19556->19558 19560 b6b66e 19558->19560 19562 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19560->19562 19561 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19561->19556 19563 b6b683 19562->19563 19580 b6e5c8 19563->19580 19566 b66632 19565->19566 19576 b666b5 ctype 19565->19576 19567 b71187 std::_Mutex::_Mutex 73 API calls 19566->19567 19566->19576 19568 b66642 19567->19568 19569 b6668d 19568->19569 19586 b66580 19568->19586 19569->19576 19597 b66350 19569->19597 19576->19555 19578 b70d72 std::exception::exception 61 API calls 19577->19578 19579 b6b64a 19578->19579 19579->19561 19581 b6e5d6 19580->19581 19584 b6e5e0 19580->19584 19628 b6e466 19581->19628 19583 b71187 std::_Mutex::_Mutex 73 API calls 19585 b6e5e8 19583->19585 19584->19583 19585->19550 19587 b64570 std::_String_base::_Xlen 73 API calls 19586->19587 19588 b665a4 19587->19588 19589 b662c0 19588->19589 19590 b6e427 std::_Lockit::_Lockit EnterCriticalSection 19589->19590 19591 b662f0 19590->19591 19602 b6e76f 19591->19602 19594 b665b0 19612 b6e8d8 19594->19612 19624 b6e606 19597->19624 19599 b66386 ctype 19600 b6e44f std::locale::_Locimp::_Locimp_dtor LeaveCriticalSection 19599->19600 19601 b6640c 19600->19601 19601->19576 19603 b6e77f 19602->19603 19604 b73983 _setlocale 109 API calls 19603->19604 19605 b6e790 19604->19605 19606 b64650 std::_Locinfo::_Locinfo_ctor 73 API calls 19605->19606 19607 b6e7a7 19606->19607 19608 b6e7b3 19607->19608 19609 b73983 _setlocale 109 API calls 19607->19609 19610 b64650 std::_Locinfo::_Locinfo_ctor 73 API calls 19608->19610 19609->19608 19611 b6632d 19610->19611 19611->19594 19613 b742ee ____lc_handle_func 69 API calls 19612->19613 19614 b6e8e3 19613->19614 19615 b742c8 ____lc_codepage_func 69 API calls 19614->19615 19616 b6e8f0 19615->19616 19617 b746ca __calloc_crt 61 API calls 19616->19617 19625 b6e614 19624->19625 19627 b6e62a 19624->19627 19626 b73983 _setlocale 109 API calls 19625->19626 19626->19627 19627->19599 19629 b71a1c __cinit 72 API calls 19628->19629 19632 b6e473 19629->19632 19630 b6e47e 19630->19584 19631 b72970 19634 b7c851 _abort 6 API calls 19631->19634 19632->19630 19632->19631 19633 b77a6c __NMSG_WRITE 61 API calls 19632->19633 19633->19631 19635 b72976 19634->19635 19636 b72981 _memset 19635->19636 19637 b7c85e _raise 61 API calls 19635->19637 19638 b72a59 19636->19638 19640 b72a19 SetUnhandledExceptionFilter UnhandledExceptionFilter 19636->19640 19637->19636 19639 b779ea _abort 61 API calls 19638->19639 19641 b72a60 19639->19641 19640->19638 19643 b6621c std::_String_base::_Xlen 19642->19643 19644 b64570 std::_String_base::_Xlen 73 API calls 19643->19644 19645 b66245 19644->19645 19645->19457 19647 b71187 std::_Mutex::_Mutex 73 API calls 19646->19647 19648 b6eb25 19647->19648 19651 b6eb61 InitializeCriticalSection 19648->19651 19650 b6a366 19650->19403 19651->19650 19653 b69745 19652->19653 19654 b6974d 19652->19654 19665 b6eb4a 19653->19665 19656 b69770 19654->19656 19668 b68300 19654->19668 19656->19272 19656->19273 19659 b6a280 19658->19659 19660 b6a241 19658->19660 19659->19274 19660->19659 19661 b66920 73 API calls 19660->19661 19661->19659 19673 b6eb91 LeaveCriticalSection 19662->19673 19664 b6eb5a 19664->19276 19672 b6eb81 EnterCriticalSection 19665->19672 19667 b6eb51 19667->19654 19669 b68311 19668->19669 19670 b68348 19669->19670 19671 b66920 73 API calls 19669->19671 19670->19656 19671->19670 19672->19667 19673->19664 19745 b67bb9 19744->19745 19745->19318 19746 b68640 19745->19746 19747 b71187 std::_Mutex::_Mutex 73 API calls 19746->19747 19748 b6866d 19747->19748 19751 b692f0 19748->19751 19750 b67c7c 19750->19307 19750->19310 19752 b69300 19751->19752 19756 b69313 19751->19756 19753 b6930a 19752->19753 19757 b6a600 19752->19757 19754 b658d0 std::_Locinfo::_Locinfo_ctor 73 API calls 19753->19754 19754->19756 19756->19750 19756->19756 19758 b64950 std::_Locinfo::_Locinfo_ctor 73 API calls 19757->19758 19759 b6a64e 19758->19759 19760 b610c0 std::_String_base::_Xlen 73 API calls 19759->19760 19761 b6a664 19760->19761 19762 b7249b __CxxThrowException@8 KiUserExceptionDispatcher 19761->19762 19764 b6a67b 19762->19764 19763 b6a697 19763->19753 19764->19763 19767 b6eb91 LeaveCriticalSection 19764->19767 19766 b6eb5a 19766->19753 19767->19766 19769 b64570 std::_String_base::_Xlen 73 API calls 19768->19769 19770 b67f37 19769->19770 19770->19341 19772 b69355 19771->19772 19773 b69359 19771->19773 19785 b6a430 19772->19785 19774 b69362 19773->19774 19776 b71349 6 API calls 19773->19776 19774->19772 19777 b71349 6 API calls 19774->19777 19776->19774 19777->19772 19778 b69393 19779 b693a0 19778->19779 19780 b71349 6 API calls 19778->19780 19781 b71349 6 API calls 19779->19781 19782 b693b1 19779->19782 19780->19779 19781->19782 19783 b71349 6 API calls 19782->19783 19784 b6875c 19782->19784 19783->19784 19784->18149 19787 b6a442 19785->19787 19786 b6a464 19789 b6a52e 19786->19789 19796 b6a473 19786->19796 19787->19786 19788 b6a600 74 API calls 19787->19788 19792 b6a553 _memset 19787->19792 19788->19786 19790 b6a596 19789->19790 19791 b6a544 19789->19791 19793 b6a5ac 19790->19793 19795 b70f78 _memmove_s 62 API calls 19790->19795 19791->19792 19794 b70f78 _memmove_s 62 API calls 19791->19794 19792->19778 19793->19792 19798 b70f78 _memmove_s 62 API calls 19793->19798 19794->19792 19795->19793 19797 b658d0 std::_Locinfo::_Locinfo_ctor 73 API calls 19796->19797 19799 b6a495 19797->19799 19798->19792 19799->19799 19800 b6a4d4 19799->19800 19801 b70f78 _memmove_s 62 API calls 19799->19801 19802 b6a4f5 ctype 19800->19802 19803 b70f78 _memmove_s 62 API calls 19800->19803 19801->19800 19802->19778 19803->19802 19805 b78f24 19804->19805 19806 b78f3a EnterCriticalSection 19804->19806 19807 b76501 __lock 61 API calls 19805->19807 19806->19365 19808 b78f2d 19807->19808 19808->19365 19810 b78c09 __fileno 61 API calls 19809->19810 19811 b7b5c2 19810->19811 19812 b805d7 __write_nolock 61 API calls 19811->19812 19813 b7b5c8 _printf 19812->19813 19814 b7b615 19813->19814 19815 b74685 __malloc_crt 61 API calls 19813->19815 19814->19368 19815->19814 19837 b6c006 19836->19837 19838 b71349 6 API calls 19837->19838 19839 b6c00f 19837->19839 19838->19839 19840 b6c04a 19839->19840 19841 b6a600 74 API calls 19839->19841 19845 b6c116 19839->19845 19842 b6c107 19840->19842 19844 b6c05c 19840->19844 19841->19840 19843 b70f78 _memmove_s 62 API calls 19842->19843 19842->19845 19843->19845 19846 b658d0 std::_Locinfo::_Locinfo_ctor 73 API calls 19844->19846 19845->19392 19847 b6c07e 19846->19847 19848 b6c097 19847->19848 19849 b70f78 _memmove_s 62 API calls 19847->19849 19850 b70f78 _memmove_s 62 API calls 19848->19850 19852 b6c0b6 19848->19852 19849->19848 19850->19852 19851 b6c0d1 ctype 19851->19392 19852->19851 19853 b70f78 _memmove_s 62 API calls 19852->19853 19853->19851 19929 b6cfa0 19854->19929 19859 b6c870 19860 b6c8f9 19859->19860 19930 b71187 std::_Mutex::_Mutex 73 API calls 19929->19930 19931 b6cfcc 19930->19931 19939 b64800 19931->19939 19934 b6d380 19935 b71187 std::_Mutex::_Mutex 73 API calls 19934->19935 19936 b6d3ac 19935->19936 19942 b650d0 19936->19942 19940 b71187 std::_Mutex::_Mutex 73 API calls 19939->19940 19941 b6480a 19940->19941 19941->19934 19943 b71187 std::_Mutex::_Mutex 73 API calls 19942->19943 19944 b650da 19943->19944 19944->19859 20586 b778b4 ___BuildCatchObject 20585->20586 20587 b76501 __lock 61 API calls 20586->20587 20588 b778bb 20587->20588 20589 b77984 __initterm 20588->20589 20591 b778e7 20588->20591 20604 b779bf 20589->20604 20593 b77212 __decode_pointer 6 API calls 20591->20593 20595 b778f2 20593->20595 20594 b779bc ___BuildCatchObject 20594->17461 20597 b77974 __initterm 20595->20597 20599 b77212 __decode_pointer 6 API calls 20595->20599 20597->20589 20598 b779b3 20600 b777b8 _malloc 3 API calls 20598->20600 20603 b77907 20599->20603 20600->20594 20601 b77212 6 API calls __decode_pointer 20601->20603 20602 b77209 6 API calls _raise 20602->20603 20603->20597 20603->20601 20603->20602 20605 b779c5 20604->20605 20606 b779a0 20604->20606 20609 b76427 LeaveCriticalSection 20605->20609 20606->20594 20608 b76427 LeaveCriticalSection 20606->20608 20608->20598 20609->20606

                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                        Function 00B671B0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 0 b671b0-b67234 call b75c90 call b64570 call b66b60 7 b67236-b6723f call b680e0 0->7 8 b67242-b67247 0->8 7->8 10 b67255-b67259 8->10 11 b67249-b67252 call b680e0 8->11 14 b67266-b67296 call b64c60 10->14 15 b6725b-b67264 call b680e0 10->15 11->10 21 b6729b-b672b1 call b66ec0 call b67800 14->21 22 b67298 14->22 15->14 27 b672b3-b672d5 call b70d72 call b7249b 21->27 28 b672da-b672e5 21->28 22->21 27->28 30 b672e7 28->30 31 b672ea-b672fc call b67890 28->31 30->31 36 b672fe-b6731a call b70d72 call b7249b 31->36 37 b6731f-b67325 31->37 36->37 39 b67327 37->39 40 b6732a-b6733e call b67940 37->40 39->40 45 b67367-b67370 40->45 46 b67340-b67362 call b70d72 call b7249b 40->46 47 b67375-b67380 call b679f0 45->47 48 b67372 45->48 46->45 54 b67382-b6739e call b70d72 call b7249b 47->54 55 b673a3-b673b1 call b67a70 47->55 48->47 54->55 61 b673b3-b673fc GetLastError call b687c0 call b6b6c0 call b68180 call b688f0 55->61 62 b6742c-b67433 call b67af0 55->62 83 b67406-b67409 61->83 84 b673fe-b67404 61->84 67 b67435-b67457 call b70d72 call b7249b 62->67 68 b6745c-b674b2 call b67be0 call b64570 call b63c40 62->68 67->68 87 b6771f-b67768 call b70d72 call b7249b call b64650 68->87 88 b674b8-b674c9 68->88 86 b6740c-b67427 call b70d72 call b7249b 83->86 84->86 86->62 91 b674d1-b67510 call b71b1c call b67be0 call b64570 call b63c40 88->91 92 b674cb 88->92 109 b67516-b6755c call b64570 call b63bd0 call b67d80 call b63c40 91->109 110 b676f8-b6771a call b70d72 call b7249b 91->110 92->91 122 b67575-b6757c 109->122 123 b6755e-b67564 109->123 110->87 124 b67583-b675b0 call b685e0 call b68060 122->124 125 b67566 123->125 126 b67569-b67572 call b71b1c 123->126 133 b675b2-b675b7 124->133 134 b675bd-b67638 call b686a0 call b68710 call b63c40 * 2 call b67790 call b63d70 * 2 call b70d52 124->134 125->126 126->122 133->134 135 b6763b-b67670 call b71d4a call b69470 133->135 145 b67677-b676f3 call b74320 call b686f0 * 2 call b686d0 call b6b8f0 call b686a0 135->145 146 b67672 call b71349 135->146 145->124 146->145
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B66B60: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00B66BCD
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B672C4
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B672D5
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B6730C
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6731A
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B67351
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B67362
                                                                                                                                                                                                          • Part of subcall function 00B680E0: InternetCloseHandle.WININET(?), ref: 00B68122
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,0000000F), ref: 00B673B3
                                                                                                                                                                                                          • Part of subcall function 00B68180: std::_Lockit::_Lockit.LIBCPMT ref: 00B681F6
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B67416
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B67427
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B67446
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B67457
                                                                                                                                                                                                        • _printf.LIBCMT ref: 00B6764F
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B67709
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6771A
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B67730
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6739E
                                                                                                                                                                                                          • Part of subcall function 00B7249B: KiUserExceptionDispatcher.NTDLL(?,?,00B711EB,?,?,?,?,?,00B711EB,?,00B8C4F0,00B91320), ref: 00B724DD
                                                                                                                                                                                                          • Part of subcall function 00B67A70: HttpSendRequestW.WININET(?,00000000,00000000,00B8AA8F,00000000), ref: 00B67AB9
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B67390
                                                                                                                                                                                                          • Part of subcall function 00B70D72: _strlen.LIBCMT ref: 00B70D8C
                                                                                                                                                                                                          • Part of subcall function 00B70D72: _malloc.LIBCMT ref: 00B70D95
                                                                                                                                                                                                          • Part of subcall function 00B70D72: _strcpy_s.LIBCMT ref: 00B70DA7
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B67741
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throwstd::exception::exception$ByteCharCloseDispatcherErrorExceptionHandleHttpInternetLastLockitLockit::_MultiRequestSendUserWide_malloc_printf_strcpy_s_strlenstd::_
                                                                                                                                                                                                        • String ID: %s$Accept: */*$Error:SendRequest failed dwErr:$X-Interval
                                                                                                                                                                                                        • API String ID: 473927878-2315201066
                                                                                                                                                                                                        • Opcode ID: 410842af9ab14b2b2e0873f213e2d87a67d0c080f60c93ebb32b0cac1bb84ba5
                                                                                                                                                                                                        • Instruction ID: 2dfc1d14c8b9ff89005d6119b6d4354589433ea0f7627008643b94a2d457892e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 410842af9ab14b2b2e0873f213e2d87a67d0c080f60c93ebb32b0cac1bb84ba5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A028471904249DBDF10EFA4CC41BEEB7F5BF14304F508599F91967252EB78AA08CBA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B62F30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B62F5C
                                                                                                                                                                                                        • SHGetValueW.SHLWAPI ref: 00B62F94
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B62FBD
                                                                                                                                                                                                        • PathCombineW.SHLWAPI(?,?,Bin\360Desktop.exe,?,?), ref: 00B62FD7
                                                                                                                                                                                                        • PathFileExistsW.KERNELBASE(?), ref: 00B62FE2
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B63006
                                                                                                                                                                                                          • Part of subcall function 00B62E30: _memset.LIBCMT ref: 00B62E5A
                                                                                                                                                                                                          • Part of subcall function 00B62E30: GetFileVersionInfoSizeW.VERSION(?,00000000), ref: 00B62E80
                                                                                                                                                                                                          • Part of subcall function 00B62E30: GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,00000000), ref: 00B62EA1
                                                                                                                                                                                                          • Part of subcall function 00B62E30: VerQueryValueW.VERSION(?,00B8AAC4,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00B62EBE
                                                                                                                                                                                                          • Part of subcall function 00B62E30: _memset.LIBCMT ref: 00B62ECF
                                                                                                                                                                                                          • Part of subcall function 00B62E30: __snwprintf.LIBCMT ref: 00B62EF7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe, xrefs: 00B62F7A
                                                                                                                                                                                                        • Bin\360Desktop.exe, xrefs: 00B62FC5
                                                                                                                                                                                                        • Path, xrefs: 00B62F75
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$File$InfoPathValueVersion$CombineExistsQuerySize__snwprintf
                                                                                                                                                                                                        • String ID: Bin\360Desktop.exe$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe
                                                                                                                                                                                                        • API String ID: 3634268210-1130433031
                                                                                                                                                                                                        • Opcode ID: ec0f5785d827a4df4014e8be3822c88f059ed7fbfd9a6abe61739befd5dae021
                                                                                                                                                                                                        • Instruction ID: facb493e20df50df9fd2c0399ee71dbdf9c7f5ff807180286d635efb2198b092
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ec0f5785d827a4df4014e8be3822c88f059ed7fbfd9a6abe61739befd5dae021
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 942182B2614301ABD724EF60DC86BAF73E9EFD8700F40492DB59982151EF749248C792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B66EC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 130networkCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 191 b66ec0-b66fd6 call b75c90 call b75ae0 * 4 InternetCrackUrlW 202 b66fe5-b66fef 191->202 203 b66fd8-b66fe2 call b71d4a 191->203 204 b66ff2-b66ffb 202->204 203->202 204->204 206 b66ffd-b6701d call b64c60 204->206 210 b67020-b67029 206->210 210->210 211 b6702b-b67043 call b64c60 210->211 214 b67067-b6708f call b70d52 211->214 215 b67045-b6704e 211->215 216 b67050-b67059 215->216 216->216 218 b6705b-b67062 call b64b80 216->218 218->214
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$CrackInternet_printf
                                                                                                                                                                                                        • String ID: <$Error:InternetCrackUrl failed!
                                                                                                                                                                                                        • API String ID: 2405482379-3291073569
                                                                                                                                                                                                        • Opcode ID: 2d5231718d76130b08b0954c84fed4f0c8814bb0373c3bf24a6f128b9ad51eaf
                                                                                                                                                                                                        • Instruction ID: b7191d6797664ab899bb4d445e643e6ba45598471ce037e685e556a19b5567cb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2d5231718d76130b08b0954c84fed4f0c8814bb0373c3bf24a6f128b9ad51eaf
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4451A0715087418FD324DF18C842B9BB7E5FF88704F008A6DF69A97391EB75A608CB52
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B62E30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 221 b62e30-b62e6c call b75c90 call b75ae0 226 b62e72-b62e74 221->226 227 b62f19-b62f2f call b70d52 221->227 226->227 229 b62e7a-b62e87 GetFileVersionInfoSizeW 226->229 229->227 231 b62e8d-b62e92 229->231 231->227 232 b62e98-b62ea8 GetFileVersionInfoW 231->232 232->227 233 b62eaa-b62ec5 VerQueryValueW 232->233 233->227 234 b62ec7-b62f18 call b75ae0 call b71a33 call b70d52 233->234
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B62E5A
                                                                                                                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,00000000), ref: 00B62E80
                                                                                                                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,00000000), ref: 00B62EA1
                                                                                                                                                                                                        • VerQueryValueW.VERSION(?,00B8AAC4,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00B62EBE
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B62ECF
                                                                                                                                                                                                        • __snwprintf.LIBCMT ref: 00B62EF7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileInfoVersion_memset$QuerySizeValue__snwprintf
                                                                                                                                                                                                        • String ID: %d.%d.%d.%d
                                                                                                                                                                                                        • API String ID: 3281049495-3491811756
                                                                                                                                                                                                        • Opcode ID: 483b75cc01a05defdc82f2aa62c5038334cee8813211af246d3a7bd7bf190610
                                                                                                                                                                                                        • Instruction ID: f7bb95eeead0f0e281ce5b78bf44ccdeec527eb2dfe1fabca8d1375125bb4cb1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 483b75cc01a05defdc82f2aa62c5038334cee8813211af246d3a7bd7bf190610
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2321A7B15047006AF324DB50CC46F7BB3E8DF94700F44C96DBE58961A1EA78D944C7A6
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6FCC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 241 b6fcc0-b6fcde 242 b6fce4-b6fce7 241->242 243 b6fe3d-b6fe54 call b70d52 241->243 242->243 245 b6fced-b6fd3d call b75ae0 SHGetValueA 242->245 245->243 249 b6fd43-b6fd4d 245->249 250 b6fd50-b6fd55 249->250 250->250 251 b6fd57-b6fd5c 250->251 251->243 252 b6fd62-b6fd74 251->252 253 b6fd76-b6fd7b 252->253 254 b6fd8e-b6fd90 253->254 255 b6fd7d-b6fd82 253->255 257 b6fd92 254->257 258 b6fd93-b6fdad 254->258 255->254 256 b6fd84-b6fd8a 255->256 256->253 259 b6fd8c 256->259 257->258 260 b6fdb0-b6fdb8 258->260 259->257 261 b6fdba-b6fdbf 260->261 262 b6fdcb-b6fdcd 260->262 261->262 263 b6fdc1-b6fdc7 261->263 264 b6fdd0-b6fe14 call b75ae0 call b6eec0 lstrcmpiA 262->264 265 b6fdcf 262->265 263->260 266 b6fdc9 263->266 264->243 271 b6fe16-b6fe3c call b6ecf0 call b70d52 264->271 265->264 266->265
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6FD0C
                                                                                                                                                                                                        • SHGetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,?,?,?,?,00000400), ref: 00B6FD35
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6FDE2
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,?), ref: 00B6FE0A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$Valuelstrcmpi
                                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                                        • API String ID: 999496690-2395435937
                                                                                                                                                                                                        • Opcode ID: fb178b2d06e8da8d81e1c60883f0acfc1adbbbe935cb6b7758ff1bea539aa350
                                                                                                                                                                                                        • Instruction ID: 5813243c21b0e4edbc87aa2c89c4a89a23f8b64a4bf6e587a6a9ded2bf24ed16
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb178b2d06e8da8d81e1c60883f0acfc1adbbbe935cb6b7758ff1bea539aa350
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0741443210434A8FD734CB24D841BFB77E8EF95704F0449BDE99A87181EB34A909CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B65280 Relevance: 4.6, APIs: 3, Instructions: 116COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 276 b65280-b652bc 277 b652c2-b652d4 276->277 278 b652be-b652c0 276->278 279 b652e4-b652ee 277->279 280 b652d6-b652df 277->280 278->279 282 b65302-b6530c 279->282 283 b652f0 279->283 280->279 281 b652e1 280->281 281->279 284 b652f2-b652f6 call b71187 282->284 285 b6530e-b6534f call b70d72 call b7249b call b65930 282->285 283->284 288 b652fb-b6535e 284->288 292 b65383-b65387 288->292 293 b65360-b65364 288->293 297 b65398-b653a8 292->297 298 b65389-b65395 call b70ef0 292->298 295 b65366-b65369 293->295 296 b6536b 293->296 300 b6536e-b65380 call b70efb 295->300 296->300 302 b653ac-b653c3 297->302 303 b653aa 297->303 298->297 300->292 303->302
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throw_memcpy_sstd::exception::exception
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 464988439-0
                                                                                                                                                                                                        • Opcode ID: 80354ebcc14e304aa823a4f61ede5afe7b088930127038cb6608be19bb6d6ba7
                                                                                                                                                                                                        • Instruction ID: af34c7485a34ad840f6383a0405cc08b43d45dad1d9e13b054f6ffb39e7b323d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 80354ebcc14e304aa823a4f61ede5afe7b088930127038cb6608be19bb6d6ba7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9A41E8B1900A05DBCB14DF68C88199EB3F5FF44710F5086AEE426D7741E774A924CBE4
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B7C379 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 308 b7c379-b7c388 GetEnvironmentStringsW 309 b7c38e-b7c391 308->309 310 b7c38a-b7c38d 308->310 311 b7c393-b7c398 309->311 312 b7c3a1-b7c3aa call b74685 309->312 311->311 314 b7c39a-b7c39f 311->314 315 b7c3af-b7c3b4 312->315 314->311 314->312 316 b7c3b6-b7c3c2 FreeEnvironmentStringsW 315->316 317 b7c3c3-b7c3ce call b74320 315->317 317->316
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(00000000,00B72338), ref: 00B7C37C
                                                                                                                                                                                                        • __malloc_crt.LIBCMT ref: 00B7C3AA
                                                                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B7C3B7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EnvironmentStrings$Free__malloc_crt
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 237123855-0
                                                                                                                                                                                                        • Opcode ID: 572dec85ee5062546ad10919d86ada7964015e4d87b598ec9535987fa19c3bac
                                                                                                                                                                                                        • Instruction ID: 40576b984d2411040d7efd9c86326953774661f00c8b61f053457902c423a54c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 572dec85ee5062546ad10919d86ada7964015e4d87b598ec9535987fa19c3bac
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63F082775151205E8B617A357C488BA1AEDDBCA36A323C4ADF4BAD3141FE384D4383A9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B71187 Relevance: 4.5, APIs: 3, Instructions: 34COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 320 b71187-b7118f 321 b7119e-b711a9 call b713a8 320->321 324 b71191-b7119c call b77167 321->324 325 b711ab-b711ac 321->325 324->321 328 b711ad-b711b9 324->328 329 b711d4-b711eb call b62e10 call b7249b 328->329 330 b711bb-b711d3 call b7116c call b71a1c 328->330 330->329
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00B711A1
                                                                                                                                                                                                          • Part of subcall function 00B713A8: __FF_MSGBANNER.LIBCMT ref: 00B713CB
                                                                                                                                                                                                          • Part of subcall function 00B713A8: __NMSG_WRITE.LIBCMT ref: 00B713D2
                                                                                                                                                                                                          • Part of subcall function 00B713A8: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00B74696,?,00000001,?,?,00B7648B,00000018,00B8C0B8,0000000C,00B7651C), ref: 00B7141F
                                                                                                                                                                                                        • std::bad_alloc::bad_alloc.LIBCMT ref: 00B711C4
                                                                                                                                                                                                          • Part of subcall function 00B7116C: std::exception::exception.LIBCMT ref: 00B71178
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B711E6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3715980512-0
                                                                                                                                                                                                        • Opcode ID: 5e89e462087a4dd6af94d9f66a74b577000690b18d3f6daf98e84581c553a531
                                                                                                                                                                                                        • Instruction ID: 23a443c25b68186bc679b493562fcfa853ab2157dc2bccc6f4775f038113ae3f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e89e462087a4dd6af94d9f66a74b577000690b18d3f6daf98e84581c553a531
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D7F0E23990820936CF04B73DD806A5A3BE88B40354B90CCF4FD39BA8A2DE21D945DB74
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B67940 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48networkCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 339 b67940-b6798d 340 b67997-b679e8 HttpOpenRequestW 339->340 341 b6798f-b67994 339->341 341->340
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HttpOpenRequestW.WININET(?,GET,?,00000000,00000000,00000000,844C8200,00000000), ref: 00B679AA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HttpOpenRequest
                                                                                                                                                                                                        • String ID: GET
                                                                                                                                                                                                        • API String ID: 1984915467-1805413626
                                                                                                                                                                                                        • Opcode ID: 1663046d74ccea4855153779bf75d801f354f56c5bcfd6845174946248106e5f
                                                                                                                                                                                                        • Instruction ID: ddb0e57942d389a130c667bfcde68caff0a5ea0eefb1d42c0a4bf8b60844356e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1663046d74ccea4855153779bf75d801f354f56c5bcfd6845174946248106e5f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A00180B1A84308AFEB10DF99CC45BAFBBF8EB04B14F10466AF515A72D0D7795900CBA4
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B67800 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38networkCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 344 b67800-b6788a InternetOpenW
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetOpenW.WININET(WinInetGet/0.1,00000000,00000000,00000000,00000000), ref: 00B6784E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InternetOpen
                                                                                                                                                                                                        • String ID: WinInetGet/0.1
                                                                                                                                                                                                        • API String ID: 2038078732-3566862317
                                                                                                                                                                                                        • Opcode ID: 7286e617a60b53ae4297f05ad383871145815bb54d4f0e790c29a69d387940c0
                                                                                                                                                                                                        • Instruction ID: ec196f270edb5212a568a1bb4a2905108644e402fa53ea4c8aee0a0ca72ee19f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7286e617a60b53ae4297f05ad383871145815bb54d4f0e790c29a69d387940c0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E01AFB1A84308ABD720DF99DC46B9ABBF8F704B20F20466AF111A72E0D7742500CB94
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6524E Relevance: 3.1, APIs: 2, Instructions: 93COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 347 b6524e-b65255 348 b65257-b65260 call b70ef0 347->348 349 b65263-b652bc call b7249b 347->349 348->349 355 b652c2-b652d4 349->355 356 b652be-b652c0 349->356 357 b652e4-b652ee 355->357 358 b652d6-b652df 355->358 356->357 360 b65302-b6530c 357->360 361 b652f0 357->361 358->357 359 b652e1 358->359 359->357 362 b652f2-b652f6 call b71187 360->362 363 b6530e-b6534f call b70d72 call b7249b call b65930 360->363 361->362 366 b652fb-b6535e 362->366 370 b65383-b65387 366->370 371 b65360-b65364 366->371 375 b65398-b653a8 370->375 376 b65389-b65395 call b70ef0 370->376 373 b65366-b65369 371->373 374 b6536b 371->374 378 b6536e-b65380 call b70efb 373->378 374->378 380 b653ac-b653c3 375->380 381 b653aa 375->381 376->375 378->370 381->380
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throw_memcpy_s
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4160651998-0
                                                                                                                                                                                                        • Opcode ID: af127371201744389c4ea253e7ae7d3497d2595a3ee5f608d5a8556699197a70
                                                                                                                                                                                                        • Instruction ID: 21a22364edcdd0acbd775577386278275060dc933627d1b5777cd01640f7543b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: af127371201744389c4ea253e7ae7d3497d2595a3ee5f608d5a8556699197a70
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F31B0B1900A04EBDB24DF58C881A5AB3E5FB44700F108A6EE82697B41E774B924C7E4
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B777B8 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 386 b777b8-b777c9 call b7778d ExitProcess
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___crtCorExitProcess.LIBCMT ref: 00B777C0
                                                                                                                                                                                                          • Part of subcall function 00B7778D: GetModuleHandleW.KERNEL32(mscoree.dll,?,00B777C5,?,?,00B713E1,000000FF,0000001E,?,00B74696,?,00000001,?,?,00B7648B,00000018), ref: 00B77797
                                                                                                                                                                                                          • Part of subcall function 00B7778D: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B777A7
                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00B777C9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2427264223-0
                                                                                                                                                                                                        • Opcode ID: 9e537f269cb724790b199ab3ae5c6b742db0d17c0f9d1817bf1e3929781d4ce3
                                                                                                                                                                                                        • Instruction ID: 323136ac9c2b6b45839b7a494ee4a1f0701f23cebeb2e8b101845752a3763352
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e537f269cb724790b199ab3ae5c6b742db0d17c0f9d1817bf1e3929781d4ce3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 97B09231044148BBCB063F12DC8EC493F6AEB843A1B508060F8282A031DF72ADA2DBC0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B67890 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 389 b67890-b678dc 390 b678e6-b67936 InternetConnectW 389->390 391 b678de-b678e3 389->391 391->390
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B678F8
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ConnectInternet
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3050416762-0
                                                                                                                                                                                                        • Opcode ID: bcd1f9f621ca3e05ccc4ade19e3d78e12a1c1e92a5355e8abbfab60629026b8f
                                                                                                                                                                                                        • Instruction ID: d8177dc90285bc89b4e9f605a3d7dedb1ba1134f01155c2b4142576b215bc241
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bcd1f9f621ca3e05ccc4ade19e3d78e12a1c1e92a5355e8abbfab60629026b8f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D0180B1A44308AFDB10CFA9CD45BAEBBF8FB08710F10466AF515E72D0D77959008B94
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B64DA0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 394 b64da0-b64da9 395 b64db0-b64db5 394->395 396 b64dab call b6e35d 394->396 398 b64db7-b64dbd call b65280 395->398 399 b64dcc-b64dce 395->399 396->395 403 b64dc2-b64dcb 398->403 401 b64df2-b64dfb 399->401 402 b64dd0-b64dd6 399->402 404 b64dea-b64def 402->404 405 b64dd8-b64de9 402->405 404->401
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • std::_String_base::_Xlen.LIBCPMT ref: 00B64DAB
                                                                                                                                                                                                          • Part of subcall function 00B6E35D: __EH_prolog3.LIBCMT ref: 00B6E364
                                                                                                                                                                                                          • Part of subcall function 00B6E35D: __CxxThrowException@8.LIBCMT ref: 00B6E38F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1675473389-0
                                                                                                                                                                                                        • Opcode ID: 0c573315f04515f14719906bd303578919e1ef26043a2e3dbf037b9f020c1b35
                                                                                                                                                                                                        • Instruction ID: 976fa697807385952a200d3a07fe50fa6350319d33dfdbf7efc71ad540561845
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c573315f04515f14719906bd303578919e1ef26043a2e3dbf037b9f020c1b35
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3EF0BE32F049224A9B75AE38AD408BF22E7EFD5710329CABDE096CB684DE249C854354
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B680E0 Relevance: 1.5, APIs: 1, Instructions: 35networkCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 406 b680e0-b6811f 407 b68133-b6814b 406->407 408 b68121-b68128 InternetCloseHandle 406->408 408->407
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetCloseHandle.WININET(?), ref: 00B68122
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandleInternet
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1081599783-0
                                                                                                                                                                                                        • Opcode ID: 3260de7db613d0a5f9ace8244c796bf8b378250a1b628b365544edb68c75a8e6
                                                                                                                                                                                                        • Instruction ID: 6c688c5d28daf27b6886356dea76f86ea5f510dd62ecc7d7701004dac12adeb5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3260de7db613d0a5f9ace8244c796bf8b378250a1b628b365544edb68c75a8e6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FFF0F671904308EBCB10CF68ED41B9ABBF8FB05760F10026AF411E3690DB345500C7A0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B76355 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00B7636A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                                        • Opcode ID: c87ed2406e3fd9a9c125a6ee0d15ca826afa27dd05a69f52f4730b393dae9555
                                                                                                                                                                                                        • Instruction ID: 2922143f205522717d54fbf786f07635f33a94ce3ca34a5d83d670a7725bdd25
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c87ed2406e3fd9a9c125a6ee0d15ca826afa27dd05a69f52f4730b393dae9555
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DD05E769947055ADB005F757D087263BECD384B95F048436B91DC7160E970C540DB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B779D4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _doexit.LIBCMT ref: 00B779E0
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __lock.LIBCMT ref: 00B778B6
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __decode_pointer.LIBCMT ref: 00B778ED
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __decode_pointer.LIBCMT ref: 00B77902
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __decode_pointer.LIBCMT ref: 00B7792C
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __decode_pointer.LIBCMT ref: 00B77942
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __decode_pointer.LIBCMT ref: 00B7794F
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __initterm.LIBCMT ref: 00B7797E
                                                                                                                                                                                                          • Part of subcall function 00B778A8: __initterm.LIBCMT ref: 00B7798E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1597249276-0
                                                                                                                                                                                                        • Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                                        • Instruction ID: 4887fe31691b6d4e90ff8014a23fde04cab5fff7a7b4f593c8756c6cb6ebf8d5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 44B0927258820833EA212542EC07F063A5987C0B60E254060BA1C191A1A9A2A961809A
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 00B7CA0E Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ___getlocaleinfo
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1937885557-0
                                                                                                                                                                                                        • Opcode ID: 728d16797899a298231453e87e2a7349129bdf53b9ab2312ecac204b9942e84d
                                                                                                                                                                                                        • Instruction ID: cd1bc2331e42824e8c8ef80e2df1e43f193b2834f3344361efed660cc090db9d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 728d16797899a298231453e87e2a7349129bdf53b9ab2312ecac204b9942e84d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7E1BEB290020DBEEB11DAE1CC85EFF77FDFB04744F04496AB255E2141EA75AB059B60
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B63070 Relevance: 37.5, APIs: 4, Strings: 17, Instructions: 726COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B63100
                                                                                                                                                                                                          • Part of subcall function 00B700C0: _memset.LIBCMT ref: 00B70101
                                                                                                                                                                                                          • Part of subcall function 00B700C0: _memset.LIBCMT ref: 00B7011E
                                                                                                                                                                                                          • Part of subcall function 00B700C0: lstrlenA.KERNEL32(00000000), ref: 00B7012D
                                                                                                                                                                                                          • Part of subcall function 00B64AC0: std::_String_base::_Xlen.LIBCPMT ref: 00B64AF5
                                                                                                                                                                                                          • Part of subcall function 00B64AC0: _memcpy_s.LIBCMT ref: 00B64B44
                                                                                                                                                                                                          • Part of subcall function 00B66D20: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00B66D8C
                                                                                                                                                                                                          • Part of subcall function 00B671B0: std::exception::exception.LIBCMT ref: 00B672C4
                                                                                                                                                                                                          • Part of subcall function 00B671B0: __CxxThrowException@8.LIBCMT ref: 00B672D5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$ByteCharException@8MultiString_base::_ThrowWideXlen_memcpy_slstrlenstd::_std::exception::exception
                                                                                                                                                                                                        • String ID: &count=16&show=1&version=$1.0$10004$UTF-8$\360Desktop$\TopBarCfgImport.xml$book$cate$child$cid$count$encoding$http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=$relate_type$standalone$version$zm_d
                                                                                                                                                                                                        • API String ID: 2241216071-3947748357
                                                                                                                                                                                                        • Opcode ID: c220e4f731060891c5614b849ec240f5bd87b80df27cb9b70011beb2d7048a6e
                                                                                                                                                                                                        • Instruction ID: a56e209154552b5247ce643d918f11d5947eb086439474af52a335c2aee713ca
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c220e4f731060891c5614b849ec240f5bd87b80df27cb9b70011beb2d7048a6e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8962A071911288DBDF24EFA4CC85BED77F4EF14700F0445A9E9196B292DB786B08CBA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6F080 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B6EDF0: _vswprintf_s.LIBCMT ref: 00B6EE23
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00B6F102
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00B6F148
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00B6F153
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6F1C8
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00B6F243
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandle$ControlCreateDeviceFile_memset_vswprintf_s
                                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                        • API String ID: 759969516-2935326385
                                                                                                                                                                                                        • Opcode ID: 49e8b09a79ca08c8f9e36ccf53900aa51aea1150f1d8bc95690a1cfe2792c424
                                                                                                                                                                                                        • Instruction ID: 139f48ccb121f463501bb3698ff69b2d9ef32efbbf994934530ac5339826ecb9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49e8b09a79ca08c8f9e36ccf53900aa51aea1150f1d8bc95690a1cfe2792c424
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E518DB1508340AFE360DF24DC91BABBBE8EB88704F50496DF59CC6291EB7895448F56
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6F440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B6EDF0: _vswprintf_s.LIBCMT ref: 00B6EE23
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,00B6FFDB,?,00000064), ref: 00B6F4B5
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6F4EA
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 00B6F512
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6F52A
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00B6F578
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$CloseControlCreateDeviceFileHandle_vswprintf_s
                                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                        • API String ID: 3752575622-2935326385
                                                                                                                                                                                                        • Opcode ID: 3277e4857da1f68cb68d18e780c24b96f70e143af37f7a8edd8e390acd351563
                                                                                                                                                                                                        • Instruction ID: 4fdbf90192eb79d4ac4990d521808b234541bec3eb06dbb350c54d759361a032
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3277e4857da1f68cb68d18e780c24b96f70e143af37f7a8edd8e390acd351563
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E417F71504340AFE324DF64DC86EAFB3E8EBD9700F400E6EB55982191EB749A548B62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6F5D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B6EDF0: _vswprintf_s.LIBCMT ref: 00B6EE23
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,?,?,?), ref: 00B6F632
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00B6F67C
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00B6F68B
                                                                                                                                                                                                          • Part of subcall function 00B713A8: __FF_MSGBANNER.LIBCMT ref: 00B713CB
                                                                                                                                                                                                          • Part of subcall function 00B713A8: __NMSG_WRITE.LIBCMT ref: 00B713D2
                                                                                                                                                                                                          • Part of subcall function 00B713A8: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00B74696,?,00000001,?,?,00B7648B,00000018,00B8C0B8,0000000C,00B7651C), ref: 00B7141F
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00B6F6B7
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00B6F702
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ControlDevice$AllocateCloseCreateFileHandleHeap_malloc_vswprintf_s
                                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                        • API String ID: 15615210-2935326385
                                                                                                                                                                                                        • Opcode ID: 40aa5f85249aa3528b0d8966c470cd7442da9c5e462834dcbbfd0040fdb6e246
                                                                                                                                                                                                        • Instruction ID: 497b54cc933ed6f9608ec3c1fa03592c66bf9fd2bc53862d3f39fb92270c6ed3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 40aa5f85249aa3528b0d8966c470cd7442da9c5e462834dcbbfd0040fdb6e246
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B3193B0604300AFE360DF64EC82F7BB6E8EB88714F50596DF699D61D0E7B4D9048B56
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B70D52 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 00B75F37
                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B75F4C
                                                                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(00B88D48), ref: 00B75F57
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(C0000409), ref: 00B75F73
                                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 00B75F7A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2579439406-0
                                                                                                                                                                                                        • Opcode ID: e1f6d41dd0efb5aa153e14fc065802b9913da740b40a3c2dd15fec78bb2bb396
                                                                                                                                                                                                        • Instruction ID: b321ae370b1f74e435511c43afa0bc888a0c8c99a970c658e4c2d8583899370b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e1f6d41dd0efb5aa153e14fc065802b9913da740b40a3c2dd15fec78bb2bb396
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB21FCB8804306AFC711DF28EA846543BF8BB0C348F90485BE408973B1EFB05984EF1A
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B68060 Relevance: 1.5, APIs: 1, Instructions: 38filenetworkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetReadFile.WININET(?,?,?,?), ref: 00B680A4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileInternetRead
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 778332206-0
                                                                                                                                                                                                        • Opcode ID: 9288772615ac70c4031369cf433288dba65189f309b961bded2be9b98c570d34
                                                                                                                                                                                                        • Instruction ID: f63f897f9379f06f704ef9cf047c77714c31ea179430db7be8c43e50bfd6d47f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9288772615ac70c4031369cf433288dba65189f309b961bded2be9b98c570d34
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35F031B1904648EFC710DF99DD45BABBBF8FB48A20F10466AF415E36A0D73559008BA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B7BEE8 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_0001BEA6), ref: 00B7BEED
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3192549508-0
                                                                                                                                                                                                        • Opcode ID: 07a60aafa7b81c0931d2522982b82672f304bf1071ee16f369c5dbb088591942
                                                                                                                                                                                                        • Instruction ID: 5d1500fdd1c419938a82d56a4f86a787b3e42d28f14de1416925e603a3d83f69
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 07a60aafa7b81c0931d2522982b82672f304bf1071ee16f369c5dbb088591942
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D900270259140CB870117705C4DE5525D66A496167A148907115D5174DF904004DA12
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6FBF0 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _vswprintf_s
                                                                                                                                                                                                        • String ID: %s:%08x
                                                                                                                                                                                                        • API String ID: 677850445-2617829732
                                                                                                                                                                                                        • Opcode ID: 55d777d29b698ad8e9d81b4adcdc106d0dd748b4cd06634b7baca50094b93749
                                                                                                                                                                                                        • Instruction ID: 514c5126574f4dc57d37782bfbe382b2dc6ee62427520239318fe6fd39c67f6c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 55d777d29b698ad8e9d81b4adcdc106d0dd748b4cd06634b7baca50094b93749
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86210CB2D14719AFCB15DFA8D941AEEBBF4FB48710F10816AE819E7250E6349900CB94
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6C870 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 348COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • Unexpected character when parsing anytype: , xrefs: 00B6CBAA
                                                                                                                                                                                                        • Can't parse Json representation: , xrefs: 00B6CCCB
                                                                                                                                                                                                        • Unexpected end of Array: , xrefs: 00B6C9F7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: Can't parse Json representation: $Unexpected character when parsing anytype: $Unexpected end of Array:
                                                                                                                                                                                                        • API String ID: 0-691214487
                                                                                                                                                                                                        • Opcode ID: 4e59a11933a8c016ed536e46c4e98f2dd0a1cc2e6f16ef65321e1f659ed821f6
                                                                                                                                                                                                        • Instruction ID: b8acb77519eb27a892100ac46782f137964b23fa4a9a072f6f777c782b6a65d7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4e59a11933a8c016ed536e46c4e98f2dd0a1cc2e6f16ef65321e1f659ed821f6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31D195714083819AC734EB64C481BFBBBE4EF95700F5449ADF1D987192DB78A548CB93
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6F850 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 165registrystringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6F88F
                                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00000008,?,?,?,?), ref: 00B6F8AA
                                                                                                                                                                                                        • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?), ref: 00B6F8DC
                                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?,?,?,?,?,?), ref: 00B6F906
                                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32 ref: 00B6F93E
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6F957
                                                                                                                                                                                                          • Part of subcall function 00B6F740: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 00B6F78E
                                                                                                                                                                                                        • lstrcmpA.KERNEL32(?,00000000), ref: 00B6F988
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00B6F9D3
                                                                                                                                                                                                        • RegEnumKeyExA.ADVAPI32(?,00000001,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?), ref: 00B6F9F9
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,?), ref: 00B6FA10
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • ServiceName, xrefs: 00B6F92C
                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 00B6F8A0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseEnumOpen_memset$CreateFileQueryValuelstrcmp
                                                                                                                                                                                                        • String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
                                                                                                                                                                                                        • API String ID: 2630661138-1795789498
                                                                                                                                                                                                        • Opcode ID: 6805af680ea54d49d0c02c64db08af36fcb15d91f9fa73cb923378c7e270313d
                                                                                                                                                                                                        • Instruction ID: ccd2dab6299090e81382585ad782da90826ce88e8f8882eca112d7fc42fc824d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6805af680ea54d49d0c02c64db08af36fcb15d91f9fa73cb923378c7e270313d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE519F71644342AFE720DB64DC85FBBB3ECEB84B04F44496DB58997190EB74D908CB62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6FA70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 110COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Netbios_memset
                                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$* $2$3$7
                                                                                                                                                                                                        • API String ID: 192577218-1802369251
                                                                                                                                                                                                        • Opcode ID: 1f41569f556c687e076af391269f94dc2545cd89f13f68a3de992c840a47f7e4
                                                                                                                                                                                                        • Instruction ID: 7bfa44647c7d8b45b6ff426eaac4e0ca681a13241d9001efc16498978553c6a9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f41569f556c687e076af391269f94dc2545cd89f13f68a3de992c840a47f7e4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F413A711083805FD321DB34D851BBB7BE8AF95300F4889BEF9DC87292D6788609C7A2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B7F4F2 Relevance: 16.7, APIs: 11, Instructions: 166COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(00000001,00B88518,00000001,?,00000002,00000000,-0000009C,?,?,?,00B7F6DC,00000001,?,-00000080,?,?), ref: 00B7F521
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00B7F6DC,00000001,?,-00000080,?,?,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?), ref: 00B7F533
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(-00000080,00000000,?,?,00000000,00000000,00000002,00000000,-0000009C,?,?,?,00B7F6DC,00000001,?,-00000080), ref: 00B7F598
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00B7F5CD
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B7F5ED
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?,-00000080), ref: 00B7F602
                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00B7F610
                                                                                                                                                                                                        • __freea.LIBCMT ref: 00B7F61A
                                                                                                                                                                                                        • ___ansicp.LIBCMT ref: 00B7F644
                                                                                                                                                                                                        • ___convertcp.LIBCMT ref: 00B7F665
                                                                                                                                                                                                          • Part of subcall function 00B7F779: GetCPInfo.KERNEL32(?,-00000080,?,00000000,00000000,-0000009C,?,?,?,00B7F6DC,00000001,?,-00000080,?,?,?), ref: 00B7F7C4
                                                                                                                                                                                                          • Part of subcall function 00B7F779: GetCPInfo.KERNEL32(?,00000001,?,00B7F6DC,00000001,?), ref: 00B7F7DD
                                                                                                                                                                                                          • Part of subcall function 00B7F779: _strlen.LIBCMT ref: 00B7F7FB
                                                                                                                                                                                                          • Part of subcall function 00B7F779: _memset.LIBCMT ref: 00B7F873
                                                                                                                                                                                                          • Part of subcall function 00B7F779: MultiByteToWideChar.KERNEL32(?,00000001,?,00B7F6DC,?,00000000,?,?,?,?,?,?,?,00B7F6DC,00000001,?), ref: 00B7F88A
                                                                                                                                                                                                          • Part of subcall function 00B7F779: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00B7F6DC), ref: 00B7F8A5
                                                                                                                                                                                                        • GetStringTypeA.KERNEL32(?,?,?,?,?,00000002,00000000,-0000009C,?,?,?,00B7F6DC,00000001,?,-00000080,?), ref: 00B7F685
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide$StringType$Info_memset$ErrorLast___ansicp___convertcp__freea_malloc_strlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 820197566-0
                                                                                                                                                                                                        • Opcode ID: a1e89cfb8d72f849289d38c2ff1906a7b7b074e3c1192e9d62172a3f1af579ae
                                                                                                                                                                                                        • Instruction ID: 7526ef76fcdd29fa82c785d1c7ad57144110395c99e8dd6ff48110abe48673cb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a1e89cfb8d72f849289d38c2ff1906a7b7b074e3c1192e9d62172a3f1af579ae
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 64515D7190010BAFDF219F68DC819BE7BE9EB14354B5084BAF929D7160DB30DD60DBA4
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6D6A0 Relevance: 15.4, APIs: 10, Instructions: 376COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memmove_s$String_base::_Xlenstd::_$_memcpy_s
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3470545318-0
                                                                                                                                                                                                        • Opcode ID: 1b867c94a445e4b682a2d460b2b270f86e3f297cee80e84601c57a3635c2e797
                                                                                                                                                                                                        • Instruction ID: fc5b91fa50dc70127cc9c157f4f5c656297274fc6586cef608cb393e345e2972
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b867c94a445e4b682a2d460b2b270f86e3f297cee80e84601c57a3635c2e797
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67C16E70B182018BDB18CF19C89492FBBE6FBC8754B644A5CF49987385C738ED51CB96
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6C530 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 260COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _strncmp$_memcpy_s
                                                                                                                                                                                                        • String ID: false$null$true
                                                                                                                                                                                                        • API String ID: 4240207175-2913297407
                                                                                                                                                                                                        • Opcode ID: 52899c6b51f87a2e1331b3c87c03e45753bdcb03ffd7a0838319c572cb126429
                                                                                                                                                                                                        • Instruction ID: 9b1193f31eb57f7aee7dbfa37b83b450f3fbc8c8540987b83b199624d18b9289
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 52899c6b51f87a2e1331b3c87c03e45753bdcb03ffd7a0838319c572cb126429
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1AA1DDB15083429FD710DF28C881B2BBBE4EF99714F50099DF49A87392E779E845CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6F290 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B6EDF0: _vswprintf_s.LIBCMT ref: 00B6EE23
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 00B6F302
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6F32F
                                                                                                                                                                                                        • _strncpy.LIBCMT ref: 00B6F36B
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00B6F3A1
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00B6F40B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle_memset_strncpy_vswprintf_s
                                                                                                                                                                                                        • String ID: SCSIDISK$\\.\Scsi%d:
                                                                                                                                                                                                        • API String ID: 170396225-2176293039
                                                                                                                                                                                                        • Opcode ID: 3680081693eee1fd0db78d1f3a9598909b1a3e320578b8a0b89ce6c5943bd8a5
                                                                                                                                                                                                        • Instruction ID: f96bed2e40dcfbaa5689a176a6a5aff821c8a59f997329b503db1ee605cfb514
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3680081693eee1fd0db78d1f3a9598909b1a3e320578b8a0b89ce6c5943bd8a5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DF4184B05083419BE330DF14EC86FABB7D8EB84704F40096DF69997291DBB9A548C757
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6B930 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6B95B
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6B981
                                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 00B6BA05
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6BA14
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6BA29
                                                                                                                                                                                                        • std::locale::facet::facet_Register.LIBCPMT ref: 00B6BA44
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
                                                                                                                                                                                                        • String ID: bad cast
                                                                                                                                                                                                        • API String ID: 2820251361-3145022300
                                                                                                                                                                                                        • Opcode ID: c5e44c9d1b314f3e4ff9910ceec1eff00b18a3427db644b9f759c9a2d25845dc
                                                                                                                                                                                                        • Instruction ID: 0141573e3e33f325e515a366caf31ce52468b3e61857833ed2f3d59534405a32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c5e44c9d1b314f3e4ff9910ceec1eff00b18a3427db644b9f759c9a2d25845dc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6031BC755086028FC714EF24D881F5A73F0EB54724F108A9EE9B6972E1DF78A944CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6BA80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6BAAB
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6BAD1
                                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 00B6BB55
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6BB64
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6BB79
                                                                                                                                                                                                        • std::locale::facet::facet_Register.LIBCPMT ref: 00B6BB94
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
                                                                                                                                                                                                        • String ID: bad cast
                                                                                                                                                                                                        • API String ID: 2820251361-3145022300
                                                                                                                                                                                                        • Opcode ID: d1ed47bad2b57861a7fd93d6bbb53992691684dc96ddd012cd452107d59c9c8c
                                                                                                                                                                                                        • Instruction ID: fa2abcca9d9c8a420f800dd7c3feed150cbc22e68774ddda7cf2dcddbc62a9f5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d1ed47bad2b57861a7fd93d6bbb53992691684dc96ddd012cd452107d59c9c8c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 063191715047028FC714EF24D981F6A77E0FB54720F180A9EF962972E1DF78A985CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6B570 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6B59B
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6B5C1
                                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 00B6B645
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6B654
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6B669
                                                                                                                                                                                                        • std::locale::facet::facet_Register.LIBCPMT ref: 00B6B684
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
                                                                                                                                                                                                        • String ID: bad cast
                                                                                                                                                                                                        • API String ID: 2820251361-3145022300
                                                                                                                                                                                                        • Opcode ID: 5580d46ed73cce593fa5bce16617544bf3b2fe2656935cd4e42425d4c443b8c7
                                                                                                                                                                                                        • Instruction ID: 57aaa4490f56d9242504dd060d9e964e46dcbab8a1b7389767a9abe039d0d249
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5580d46ed73cce593fa5bce16617544bf3b2fe2656935cd4e42425d4c443b8c7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DC31A0755042018FD714EF28D991F6AB3E0EB54724F048A9EE466972D2DB38E944CBA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B66920 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6696D
                                                                                                                                                                                                          • Part of subcall function 00B7249B: KiUserExceptionDispatcher.NTDLL(?,?,00B711EB,?,?,?,?,?,00B711EB,?,00B8C4F0,00B91320), ref: 00B724DD
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B669B1
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B669F5
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B66A34
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throw$DispatcherExceptionUser
                                                                                                                                                                                                        • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                                        • API String ID: 4200477539-1866435925
                                                                                                                                                                                                        • Opcode ID: 81dfddd40be6258bc8550589f01cc5b22e6cfa5caadcfd03737062d0a54b6ba4
                                                                                                                                                                                                        • Instruction ID: 3576ef6b924210518c56beb1603c24d309a45f200f852b63f59f00ab96d0bf7b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 81dfddd40be6258bc8550589f01cc5b22e6cfa5caadcfd03737062d0a54b6ba4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C031A272158744AEC314EF64C852F9BB7E8FF84700F408A9DF5AD821E1EB75A504CB66
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6A430 Relevance: 10.7, APIs: 7, Instructions: 193COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memmove_s$_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2102975174-0
                                                                                                                                                                                                        • Opcode ID: 7f70eeb9fffccf85f40135295f620dc8808bce896d9c6378821d0c49bb37d5cb
                                                                                                                                                                                                        • Instruction ID: 22cd51d0afde03a55fed8ff7b937e9393305c820918e3f41a059de08cee6bae1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f70eeb9fffccf85f40135295f620dc8808bce896d9c6378821d0c49bb37d5cb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD51A3726042055F8B18EE3CCD9483BB7E9EFC4354B0486ADFC56AB346DA74DD058BA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6EEC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$__strlwr_strncat_vswprintf_s
                                                                                                                                                                                                        • String ID: %02x
                                                                                                                                                                                                        • API String ID: 259801040-560843007
                                                                                                                                                                                                        • Opcode ID: 5ed397303a55302a459f951262fba65dc607badd57ae1891297aa8cb6b874029
                                                                                                                                                                                                        • Instruction ID: c36a0da8495f120b614a14c95b85056c6f0779a82454bbf7c9c7a0f1be8acad5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ed397303a55302a459f951262fba65dc607badd57ae1891297aa8cb6b874029
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 784191711087419BE334EB74C895FEB77E9EF84300F004A6DF6AD87152EA75D5088BA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B7AE65 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B7AE71
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __getptd_noexit.LIBCMT ref: 00B77461
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __amsg_exit.LIBCMT ref: 00B7746E
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 00B7AE91
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00B7AEA1
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00B7AEBE
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(023017F0), ref: 00B7AEE9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                                        • String ID: Vu`Vu
                                                                                                                                                                                                        • API String ID: 4271482742-1539858069
                                                                                                                                                                                                        • Opcode ID: 1534aabe9b178f9e2cceb3c88527d47ff76e712c4d05913736a75343c461f61f
                                                                                                                                                                                                        • Instruction ID: bab915620c4e48bf719445eff8b23489eb0ab1c89cd303db33e59dd7e93a0557
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1534aabe9b178f9e2cceb3c88527d47ff76e712c4d05913736a75343c461f61f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 68016D329447119BDBA1AB64984576E77E0FB40760F2480E5E83CA76A0DF34A981DFD2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B74B62 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CreateFrameInfo.LIBCMT ref: 00B74B8A
                                                                                                                                                                                                          • Part of subcall function 00B727C8: __getptd.LIBCMT ref: 00B727D6
                                                                                                                                                                                                          • Part of subcall function 00B727C8: __getptd.LIBCMT ref: 00B727E4
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B74B94
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __getptd_noexit.LIBCMT ref: 00B77461
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __amsg_exit.LIBCMT ref: 00B7746E
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B74BA2
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B74BB0
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B74BBB
                                                                                                                                                                                                        • _CallCatchBlock2.LIBCMT ref: 00B74BE1
                                                                                                                                                                                                          • Part of subcall function 00B7286D: __CallSettingFrame@12.LIBCMT ref: 00B728B9
                                                                                                                                                                                                          • Part of subcall function 00B74C88: __getptd.LIBCMT ref: 00B74C97
                                                                                                                                                                                                          • Part of subcall function 00B74C88: __getptd.LIBCMT ref: 00B74CA5
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1602911419-0
                                                                                                                                                                                                        • Opcode ID: 1a83db0c58cc25cc94b9ada51e5759a2b80e50509c21d3025f6014c0329967c0
                                                                                                                                                                                                        • Instruction ID: cf5a01918085b74d45c6790d96112dbc5fc2d254db7c6bdb860bf9ad241d08e8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1a83db0c58cc25cc94b9ada51e5759a2b80e50509c21d3025f6014c0329967c0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A011D7B1C44209DFDB10EFA4D945AAD7BF4FF04311F10C0A9F828AB251DB399A159F94
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6F740 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B6EDF0: _vswprintf_s.LIBCMT ref: 00B6EE23
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 00B6F78E
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00B6F7DD
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00B6F82D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle_vswprintf_s
                                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$\\.\%s
                                                                                                                                                                                                        • API String ID: 2864800763-1525991222
                                                                                                                                                                                                        • Opcode ID: 7b7e5b80b2d69d48b862c5a6ac8cc5c357c2fe35b3652e6af84eac70917d880c
                                                                                                                                                                                                        • Instruction ID: 8a68820bf12634c788d6d34efae27d9261cf122750607724da50a19abd4a298c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7b7e5b80b2d69d48b862c5a6ac8cc5c357c2fe35b3652e6af84eac70917d880c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 922107B11083406FD320EF64DC85FFB76ECAB89314F40496DB6E882191D6789908C7A2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6F317 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseControlDeviceHandle_memset_strncpy
                                                                                                                                                                                                        • String ID: SCSIDISK
                                                                                                                                                                                                        • API String ID: 2460871282-255126371
                                                                                                                                                                                                        • Opcode ID: 9a93959fca76b81d4c2bdd03242a5f23a096044c022ec40e02bf498a6de9da5c
                                                                                                                                                                                                        • Instruction ID: 167b77e7b12cd768cc1682702e225711b6efbeee5e3bef0b2a762e8b330fb481
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a93959fca76b81d4c2bdd03242a5f23a096044c022ec40e02bf498a6de9da5c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD2191B46083809BE330DB14E886FABB3D8EBC4704F40096DF68997281DBB89548C75B
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6D1A0 Relevance: 7.7, APIs: 5, Instructions: 190COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: String_base::_Xlen_memmove_sstd::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2295234635-0
                                                                                                                                                                                                        • Opcode ID: 33cffabe53d1dd94f144cb55d346e6e389398532a09499ccf979d970cfd4d110
                                                                                                                                                                                                        • Instruction ID: 36580e51250408b5cad699b77400c45d0ae5dadb979116eadf46017e00f98349
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 33cffabe53d1dd94f144cb55d346e6e389398532a09499ccf979d970cfd4d110
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2A5156B0B002029FC714EF29D9D092AB7E5FF96300B508AADE46587345D739F899CBE5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6A6A0 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 462COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B66A50: std::_Lockit::_Lockit.LIBCPMT ref: 00B66A5F
                                                                                                                                                                                                          • Part of subcall function 00B6BA80: std::_Lockit::_Lockit.LIBCPMT ref: 00B6BAAB
                                                                                                                                                                                                          • Part of subcall function 00B6BA80: std::_Lockit::_Lockit.LIBCPMT ref: 00B6BAD1
                                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00B6A720
                                                                                                                                                                                                        • _localeconv.LIBCMT ref: 00B6A7A8
                                                                                                                                                                                                        • _strcspn.LIBCMT ref: 00B6A8FA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LockitLockit::_std::_$_localeconv_strcspn
                                                                                                                                                                                                        • String ID: e
                                                                                                                                                                                                        • API String ID: 331173946-4024072794
                                                                                                                                                                                                        • Opcode ID: a3aadeb5d1d89a79a876aa38c73a032520fa90df98466bbcaf106861fd6e3228
                                                                                                                                                                                                        • Instruction ID: 15f501ccb123d4162ac625637415fd517861ef30d8c56799c2031b134278218c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a3aadeb5d1d89a79a876aa38c73a032520fa90df98466bbcaf106861fd6e3228
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 781258716083809FD724DF28C880BABBBE5EFC9300F05899DE5999B352D774A945CB93
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6FE60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00B6FE84
                                                                                                                                                                                                          • Part of subcall function 00B6EEC0: _memset.LIBCMT ref: 00B6EEF5
                                                                                                                                                                                                          • Part of subcall function 00B6EEC0: _memset.LIBCMT ref: 00B6EF9B
                                                                                                                                                                                                          • Part of subcall function 00B6EEC0: _strncat.LIBCMT ref: 00B6F01F
                                                                                                                                                                                                        • SHSetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,00000001,?,?,?,?,?,?,?), ref: 00B6FF19
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$Value_strncat
                                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                                        • API String ID: 4177196402-2395435937
                                                                                                                                                                                                        • Opcode ID: d90bb1587bdfeadd240be77102052ddf6b69097d3b3fa068b84d995490e55745
                                                                                                                                                                                                        • Instruction ID: 787b52726c176d630e9208783613724e378da1bbbb2a40a6ed2264067a8ee868
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d90bb1587bdfeadd240be77102052ddf6b69097d3b3fa068b84d995490e55745
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20112931504342ABD730DB20D842BFB7BD8EF95700F8485ADF599871A2EE75950C8792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B74F0F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___BuildCatchObject.LIBCMT ref: 00B74F22
                                                                                                                                                                                                          • Part of subcall function 00B74E7D: ___BuildCatchObjectHelper.LIBCMT ref: 00B74EB3
                                                                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 00B74F39
                                                                                                                                                                                                        • ___FrameUnwindToState.LIBCMT ref: 00B74F47
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                        • API String ID: 2163707966-1018135373
                                                                                                                                                                                                        • Opcode ID: 43700127078e775d7443150afe1c24d5bc7444f6e3cfefefd6efd9a8d886ee7e
                                                                                                                                                                                                        • Instruction ID: 8a3582d8ae29dce5012964468cc3b62c8d5e6f33267cd1c35eabb521ce5575c6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43700127078e775d7443150afe1c24d5bc7444f6e3cfefefd6efd9a8d886ee7e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D901E471401109BBDF226F51CC45EEA7EAAFF19356F008090FD2D19161D736DAA1EBA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B8405A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(KERNEL32,00B7B79A), ref: 00B8405F
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00B8406F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleModuleProc
                                                                                                                                                                                                        • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                                        • API String ID: 1646373207-3105848591
                                                                                                                                                                                                        • Opcode ID: 588d4ad5b3bbedb016f5866fa42e4caa6b1e618a9687499b9f79cbd127ebc32e
                                                                                                                                                                                                        • Instruction ID: 778052439b48de45953045f0a50ab0af5d8057518c49323e18bb553afcd98976
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 588d4ad5b3bbedb016f5866fa42e4caa6b1e618a9687499b9f79cbd127ebc32e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FEF03030A40A0ED2EF102BA1BD0A6AF7BB9FB80741F9604D0D696B10F4DF7580B4D386
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6BFE0 Relevance: 6.2, APIs: 4, Instructions: 177COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memmove_s
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 800865076-0
                                                                                                                                                                                                        • Opcode ID: a880a037f773624411f5b619f1a17cc51c6bf59eb992e74ea3f84a1a746af63f
                                                                                                                                                                                                        • Instruction ID: 408ca1cdf3612b146b469f8027ba7e0a8fa4c524a6d24ef99f7976df5343270b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a880a037f773624411f5b619f1a17cc51c6bf59eb992e74ea3f84a1a746af63f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 055181757047019FC724DE39C89083A7BE5EF9A314B148AADE4AAC7742EA34ED098761
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B71711 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __flush.LIBCMT ref: 00B717D5
                                                                                                                                                                                                        • __fileno.LIBCMT ref: 00B717F5
                                                                                                                                                                                                        • __locking.LIBCMT ref: 00B717FC
                                                                                                                                                                                                        • __flsbuf.LIBCMT ref: 00B71827
                                                                                                                                                                                                          • Part of subcall function 00B747A6: __getptd_noexit.LIBCMT ref: 00B747A6
                                                                                                                                                                                                          • Part of subcall function 00B71323: __decode_pointer.LIBCMT ref: 00B7132E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3240763771-0
                                                                                                                                                                                                        • Opcode ID: ed00166549562d5b7f34f2984b0fda4c470dfeb9c5d3f16d29785296e0cca32a
                                                                                                                                                                                                        • Instruction ID: f6d8ee8c59b5b1a74f959e11f89fe55927f0e4d8966e7b54d60085daa923a8ff
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ed00166549562d5b7f34f2984b0fda4c470dfeb9c5d3f16d29785296e0cca32a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4341A571A006049FDB299F6D888455EB7F6EF80360F24C9ADE87DA7140E770DE418B61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B82568 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B8259C
                                                                                                                                                                                                        • __isleadbyte_l.LIBCMT ref: 00B825D0
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,00B789F9,?,00000000,00000000,?,?,?,?,00B789F9,00000000,?), ref: 00B82601
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,00B789F9,00000001,00000000,00000000,?,?,?,?,00B789F9,00000000,?), ref: 00B8266F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3058430110-0
                                                                                                                                                                                                        • Opcode ID: fdb7135a9821561f4509f86a904cde4b91005459ba0b85f66d5bb78cba4044e7
                                                                                                                                                                                                        • Instruction ID: 3aa1b718fbd54c4e28f19598ac65a021c09ca4cec821a28869d64e43496ad3de
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fdb7135a9821561f4509f86a904cde4b91005459ba0b85f66d5bb78cba4044e7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7531DE31A00246EFCB20EF68C895DAE7BE4FF15310F1489E9E0659B2A1E730DD80DB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B83F46 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3016257755-0
                                                                                                                                                                                                        • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                        • Instruction ID: 172235a129b1d5b20ab4264e2e07ef21fd88234fe2b5c03b6b7a85159474acae
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CC117B7240414ABBCF126F84CC558EE3FB2FB18B50B598494FE1859131D236CAB2EB81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B72D57 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B72D63
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __getptd_noexit.LIBCMT ref: 00B77461
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __amsg_exit.LIBCMT ref: 00B7746E
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B72D7A
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 00B72D88
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00B72D98
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3521780317-0
                                                                                                                                                                                                        • Opcode ID: cb2603d697abee900a4595b06fa6cf4a1e4b7bb49001d182a499607893cc5a11
                                                                                                                                                                                                        • Instruction ID: f12f78e6dc37d6dd0efd7368ba0c49335801b96e56ded321c4947aca7ca0d1a5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cb2603d697abee900a4595b06fa6cf4a1e4b7bb49001d182a499607893cc5a11
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4DF01D329447158BD730BBA89406B5977E0AB00720F10C5E9A57CAB6D2CF249A41CB96
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B69C50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: swprintf
                                                                                                                                                                                                        • String ID: %$+
                                                                                                                                                                                                        • API String ID: 233258989-2626897407
                                                                                                                                                                                                        • Opcode ID: 425cdc9af3820baabd59150951f6c59433b5cc3522ea6a7a5a95145440715dbd
                                                                                                                                                                                                        • Instruction ID: d972a7a0c457a269223c0cd0ba526a2a2ef4a2a1d7defcb9f2b03c4e31cf1cff
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 425cdc9af3820baabd59150951f6c59433b5cc3522ea6a7a5a95145440715dbd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9513B73A083446BD716AE18C8847E77BECEB45740F2059F8E981932A2E73D8D458BD2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B69E30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: swprintf
                                                                                                                                                                                                        • String ID: %$+
                                                                                                                                                                                                        • API String ID: 233258989-2626897407
                                                                                                                                                                                                        • Opcode ID: dd30c91ad3e54ba2ba144ae8f25ecce513f8561878ac9c157958c943695b5218
                                                                                                                                                                                                        • Instruction ID: 2e1a99d21838e4c789d9c3c7c969adadb9cab4852836a98e6223349f2edab8cb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dd30c91ad3e54ba2ba144ae8f25ecce513f8561878ac9c157958c943695b5218
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62517B729083409BD715DE18C884BEB3BECEB45340F2148D8F991D72A2E77E9945CBD2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6BE50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _localeconv.LIBCMT ref: 00B6BE7E
                                                                                                                                                                                                          • Part of subcall function 00B71D24: __getptd.LIBCMT ref: 00B71D24
                                                                                                                                                                                                          • Part of subcall function 00B6E938: ____lc_handle_func.LIBCMT ref: 00B6E93B
                                                                                                                                                                                                          • Part of subcall function 00B6E938: ____lc_codepage_func.LIBCMT ref: 00B6E943
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ____lc_codepage_func____lc_handle_func__getptd_localeconv
                                                                                                                                                                                                        • String ID: false$true
                                                                                                                                                                                                        • API String ID: 679402580-2658103896
                                                                                                                                                                                                        • Opcode ID: eb4632ed94144386a5ea545cfc6ea1ddd2c8d56ac99386590e3b6d8cc24f5b6c
                                                                                                                                                                                                        • Instruction ID: 0e06043dd05abff812dea236a1964ce7667c2efb25ff3fc98e9d7ac58e1dff8f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eb4632ed94144386a5ea545cfc6ea1ddd2c8d56ac99386590e3b6d8cc24f5b6c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E4417A7AD052818FC716DF388854AAA7BE1EF4630071881E5D9A5DF353D739D90ACBE0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B64B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: String_base::_Xlen_memcpy_sstd::_
                                                                                                                                                                                                        • String ID: &count=16&show=1&version=
                                                                                                                                                                                                        • API String ID: 923394732-3206526835
                                                                                                                                                                                                        • Opcode ID: 2539f880a65bff74711d035213fa6c49ba66e93a64557084a92597a0265da81c
                                                                                                                                                                                                        • Instruction ID: d253bbf2d7bcfbfea909fefd0a93fc96fbfd90c10e57d2d7d0b420c1e5590b19
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2539f880a65bff74711d035213fa6c49ba66e93a64557084a92597a0265da81c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CC21E431300B058BC734EF68D9C096AB3EAEFD17113144AAEE152CBA51EB79FC448794
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6C340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00B6C38B
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6C39A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throwstd::exception::exception
                                                                                                                                                                                                        • String ID: count
                                                                                                                                                                                                        • API String ID: 3728558374-2245608546
                                                                                                                                                                                                        • Opcode ID: 61fdcc1a1a6d8f5377a383ea7dd0b8753fa3af3f139f70882fcec860873a0dfc
                                                                                                                                                                                                        • Instruction ID: 66df9522aca9fcb2545affdc1214a1b77e51ba10f34354b100bfdb27ed26a8b2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 61fdcc1a1a6d8f5377a383ea7dd0b8753fa3af3f139f70882fcec860873a0dfc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2A21A2B1508341DFC314EF24D881A6BBBE8FB88710F408E6EF49583651E778E908CB62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B74C88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00B7281B: __getptd.LIBCMT ref: 00B72821
                                                                                                                                                                                                          • Part of subcall function 00B7281B: __getptd.LIBCMT ref: 00B72831
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B74C97
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __getptd_noexit.LIBCMT ref: 00B77461
                                                                                                                                                                                                          • Part of subcall function 00B7745E: __amsg_exit.LIBCMT ref: 00B7746E
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00B74CA5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                        • API String ID: 803148776-1018135373
                                                                                                                                                                                                        • Opcode ID: 9141375e32c6e99359493de0b92c1a0b1a3df5fb56f216c9323901ab87347d38
                                                                                                                                                                                                        • Instruction ID: 0d2e4beeae5224fabac9b25f198c4874e38a800c2d970cdc9ecfad13c4c88848
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9141375e32c6e99359493de0b92c1a0b1a3df5fb56f216c9323901ab87347d38
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB014B368022059BCF3A9F34C440AACB7F5EF10316F24C4AEE87A5A691DF358992DF41
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00B6E395 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00B6E39C
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00B6E3C7
                                                                                                                                                                                                          • Part of subcall function 00B7249B: KiUserExceptionDispatcher.NTDLL(?,?,00B711EB,?,?,?,?,?,00B711EB,?,00B8C4F0,00B91320), ref: 00B724DD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • invalid string position, xrefs: 00B6E3A1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 0000000A.00000002.2081260373.0000000000B61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081226992.0000000000B60000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081373618.0000000000B88000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081421076.0000000000B8F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        • Associated: 0000000A.00000002.2081471866.0000000000B94000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_b60000_360TopbarASS.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DispatcherExceptionException@8H_prolog3ThrowUser
                                                                                                                                                                                                        • String ID: invalid string position
                                                                                                                                                                                                        • API String ID: 2727533346-1799206989
                                                                                                                                                                                                        • Opcode ID: 84e3cf67da35f8a4286bca73cda6c29f263ce81661cb26c18aba7beb4929ed83
                                                                                                                                                                                                        • Instruction ID: 02851af2849e4424b8b3a31288f7678bcd40a391c9f5cfccc9112bc999ab0c27
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 84e3cf67da35f8a4286bca73cda6c29f263ce81661cb26c18aba7beb4929ed83
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BDD017B29101089BCB04FBE0C852FDD73F8AF14711F5804A5F200B61A1DBB85644CB60
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                        Execution Coverage:7.6%
                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:58.8%
                                                                                                                                                                                                        Signature Coverage:6.2%
                                                                                                                                                                                                        Total number of Nodes:1694
                                                                                                                                                                                                        Total number of Limit Nodes:61
                                                                                                                                                                                                        execution_graph 11156 3793470 11157 3793481 _memset 11156->11157 11160 3793390 11157->11160 11159 3793490 11161 37933c8 _memset 11160->11161 11162 37933b0 11160->11162 11174 37932e0 11161->11174 11184 379579a 11162->11184 11164 37933c1 11164->11159 11166 37933ed 11166->11162 11167 3793419 LoadLibraryA 11166->11167 11168 379342b GetProcAddress 11167->11168 11169 379344d 11167->11169 11170 379343b 11168->11170 11171 3793446 FreeLibrary 11168->11171 11172 379579a __fltout2 5 API calls 11169->11172 11170->11171 11171->11169 11173 3793462 11172->11173 11173->11159 11175 37932fe _memset 11174->11175 11181 3793343 11174->11181 11192 3793170 11175->11192 11176 379579a __fltout2 5 API calls 11177 3793385 11176->11177 11177->11166 11179 3793327 11180 379332e lstrlenW 11179->11180 11179->11181 11180->11181 11182 3793347 __alloca_probe_16 11180->11182 11181->11176 11207 3792a20 11182->11207 11185 37957a2 11184->11185 11186 37957a4 IsDebuggerPresent 11184->11186 11185->11164 11211 379ba85 11186->11211 11189 3796858 SetUnhandledExceptionFilter UnhandledExceptionFilter 11190 379687d GetCurrentProcess TerminateProcess 11189->11190 11191 3796875 __invoke_watson 11189->11191 11190->11164 11191->11190 11195 379317a _memset __write_nolock 11192->11195 11193 37932a9 11194 379579a __fltout2 5 API calls 11193->11194 11196 37932cf 11194->11196 11195->11193 11197 37931cc SHGetValueW 11195->11197 11196->11179 11198 37931fb PathFileExistsW 11197->11198 11199 379322c GetModuleFileNameW PathRemoveFileSpecW 11197->11199 11198->11199 11200 379320a PathRemoveFileSpecW 11198->11200 11201 3793255 _wcsrchr 11199->11201 11202 3793221 _wcsrchr 11200->11202 11201->11202 11203 379328d ExpandEnvironmentStringsW 11202->11203 11204 3793276 11202->11204 11203->11193 11203->11204 11205 379579a __fltout2 5 API calls 11204->11205 11206 3793286 11205->11206 11206->11179 11208 3792a29 11207->11208 11209 3792a58 11207->11209 11208->11209 11210 3792a31 WideCharToMultiByte 11208->11210 11209->11181 11210->11181 11211->11189 12335 401f51 12336 401f63 12335->12336 12345 402004 12335->12345 12337 4029e8 18 API calls 12336->12337 12338 401f6a 12337->12338 12340 4029e8 18 API calls 12338->12340 12339 401423 25 API calls 12346 40215b 12339->12346 12341 401f73 12340->12341 12342 401f88 LoadLibraryExA 12341->12342 12343 401f7b GetModuleHandleA 12341->12343 12344 401f98 GetProcAddress 12342->12344 12342->12345 12343->12342 12343->12344 12347 401fe5 12344->12347 12348 401fa8 12344->12348 12345->12339 12349 404de1 25 API calls 12347->12349 12352 401fb8 12348->12352 12353 401423 12348->12353 12349->12352 12351 401ff8 FreeLibrary 12351->12346 12352->12346 12352->12351 12354 404de1 25 API calls 12353->12354 12355 401431 12354->12355 12355->12352 10700 402164 10701 4029e8 18 API calls 10700->10701 10702 40216a 10701->10702 10703 4029e8 18 API calls 10702->10703 10704 402173 10703->10704 10705 4029e8 18 API calls 10704->10705 10706 40217c 10705->10706 10715 405d3a FindFirstFileA 10706->10715 10709 402196 lstrlenA lstrlenA 10718 404de1 10709->10718 10710 404de1 25 API calls 10714 402191 10710->10714 10713 402189 10713->10710 10713->10714 10716 405d50 FindClose 10715->10716 10717 402185 10715->10717 10716->10717 10717->10709 10717->10713 10719 404dfc 10718->10719 10728 4021d2 SHFileOperationA 10718->10728 10720 404e19 lstrlenA 10719->10720 10723 405a65 18 API calls 10719->10723 10721 404e42 10720->10721 10722 404e27 lstrlenA 10720->10722 10725 404e55 10721->10725 10726 404e48 SetWindowTextA 10721->10726 10724 404e39 lstrcatA 10722->10724 10722->10728 10723->10720 10724->10721 10727 404e5b SendMessageA SendMessageA SendMessageA 10725->10727 10725->10728 10726->10725 10727->10728 10728->10713 10728->10714 12307 40266e 12308 4029e8 18 API calls 12307->12308 12310 40267c 12308->12310 12309 402692 12312 4056fb 2 API calls 12309->12312 12310->12309 12311 4029e8 18 API calls 12310->12311 12311->12309 12313 402698 12312->12313 12333 40571a GetFileAttributesA CreateFileA 12313->12333 12315 4026a5 12316 4026b1 GlobalAlloc 12315->12316 12317 40274e 12315->12317 12318 402745 CloseHandle 12316->12318 12319 4026ca 12316->12319 12320 402756 DeleteFileA 12317->12320 12321 402769 12317->12321 12318->12317 12334 4031da SetFilePointer 12319->12334 12320->12321 12323 4026d0 12324 4031a8 ReadFile 12323->12324 12325 4026d9 GlobalAlloc 12324->12325 12326 4026e9 12325->12326 12327 40271d WriteFile GlobalFree 12325->12327 12328 402f01 47 API calls 12326->12328 12329 402f01 47 API calls 12327->12329 12332 4026f6 12328->12332 12330 402742 12329->12330 12330->12318 12331 402714 GlobalFree 12331->12327 12332->12331 12333->12315 12334->12323 14022 40276f 14023 4029cb 18 API calls 14022->14023 14024 402775 14023->14024 14025 4027b0 14024->14025 14026 402799 14024->14026 14031 40264e 14024->14031 14028 4027c6 14025->14028 14029 4027ba 14025->14029 14027 40279e 14026->14027 14035 4027ad 14026->14035 14036 405a43 lstrcpynA 14027->14036 14032 405a65 18 API calls 14028->14032 14030 4029cb 18 API calls 14029->14030 14030->14035 14032->14035 14035->14031 14037 4059a1 wsprintfA 14035->14037 14036->14031 14037->14031 11083 401b06 11084 401b13 11083->11084 11085 401b57 11083->11085 11091 401b9b 11084->11091 11092 401b2a 11084->11092 11086 401b80 GlobalAlloc 11085->11086 11087 401b5b 11085->11087 11088 405a65 18 API calls 11086->11088 11095 402200 11087->11095 11104 405a43 lstrcpynA 11087->11104 11088->11091 11089 405a65 18 API calls 11093 4021fa 11089->11093 11091->11089 11091->11095 11102 405a43 lstrcpynA 11092->11102 11093->11095 11098 405304 MessageBoxIndirectA 11093->11098 11094 401b6d GlobalFree 11094->11095 11097 401b39 11103 405a43 lstrcpynA 11097->11103 11098->11095 11100 401b48 11105 405a43 lstrcpynA 11100->11105 11102->11097 11103->11100 11104->11094 11105->11095 12416 402215 12417 402223 12416->12417 12418 40221d 12416->12418 12420 4029e8 18 API calls 12417->12420 12422 402233 12417->12422 12419 4029e8 18 API calls 12418->12419 12419->12417 12420->12422 12421 402241 12423 4029e8 18 API calls 12421->12423 12422->12421 12424 4029e8 18 API calls 12422->12424 12425 40224a WritePrivateProfileStringA 12423->12425 12424->12421 10629 401721 10635 4029e8 10629->10635 10633 40172f 10634 405749 2 API calls 10633->10634 10634->10633 10636 4029f4 10635->10636 10645 405a65 10636->10645 10639 401728 10641 405749 10639->10641 10642 405754 GetTickCount GetTempFileNameA 10641->10642 10643 405780 10642->10643 10644 405784 10642->10644 10643->10642 10643->10644 10644->10633 10658 405a72 10645->10658 10646 405c88 10647 402a15 10646->10647 10679 405a43 lstrcpynA 10646->10679 10647->10639 10663 405ca1 10647->10663 10649 405b06 GetVersion 10649->10658 10650 405c5f lstrlenA 10650->10658 10653 405a65 10 API calls 10653->10650 10654 405b7e GetSystemDirectoryA 10654->10658 10656 405b91 GetWindowsDirectoryA 10656->10658 10657 405ca1 5 API calls 10657->10658 10658->10646 10658->10649 10658->10650 10658->10653 10658->10654 10658->10656 10658->10657 10659 405bc5 SHGetSpecialFolderLocation 10658->10659 10660 405a65 10 API calls 10658->10660 10661 405c08 lstrcatA 10658->10661 10672 40592a RegOpenKeyExA 10658->10672 10677 4059a1 wsprintfA 10658->10677 10678 405a43 lstrcpynA 10658->10678 10659->10658 10662 405bdd SHGetPathFromIDListA CoTaskMemFree 10659->10662 10660->10658 10661->10658 10662->10658 10670 405cad 10663->10670 10664 405d19 CharPrevA 10668 405d15 10664->10668 10665 405d0a CharNextA 10665->10668 10665->10670 10666 405d34 10666->10639 10668->10664 10668->10666 10669 405cf8 CharNextA 10669->10670 10670->10665 10670->10668 10670->10669 10671 405d05 CharNextA 10670->10671 10680 405561 10670->10680 10671->10665 10673 40599b 10672->10673 10674 40595d RegQueryValueExA 10672->10674 10673->10658 10675 40597e RegCloseKey 10674->10675 10675->10673 10677->10658 10678->10658 10679->10647 10681 405567 10680->10681 10682 40557a 10681->10682 10683 40556d CharNextA 10681->10683 10682->10670 10683->10681 10729 403225 #17 SetErrorMode OleInitialize 10799 405d61 GetModuleHandleA 10729->10799 10733 403293 GetCommandLineA 10804 405a43 lstrcpynA 10733->10804 10735 4032a5 GetModuleHandleA 10736 4032bc 10735->10736 10737 405561 CharNextA 10736->10737 10738 4032d0 CharNextA 10737->10738 10744 4032dd 10738->10744 10739 403346 10740 403359 GetTempPathA 10739->10740 10805 4031f1 10740->10805 10742 40336f 10745 403393 DeleteFileA 10742->10745 10746 403373 GetWindowsDirectoryA lstrcatA 10742->10746 10743 405561 CharNextA 10743->10744 10744->10739 10744->10743 10750 403348 10744->10750 10813 402c5b GetTickCount GetModuleFileNameA 10745->10813 10747 4031f1 11 API calls 10746->10747 10749 40338f 10747->10749 10749->10745 10752 403411 ExitProcess OleUninitialize 10749->10752 10898 405a43 lstrcpynA 10750->10898 10751 4033a4 10751->10752 10754 4033fd 10751->10754 10758 405561 CharNextA 10751->10758 10755 403426 10752->10755 10756 40350b 10752->10756 10843 4035e3 10754->10843 10915 405304 10755->10915 10760 40358e ExitProcess 10756->10760 10761 405d61 3 API calls 10756->10761 10763 4033bb 10758->10763 10766 40351a 10761->10766 10769 4033d8 10763->10769 10770 40343c lstrcatA lstrcmpiA 10763->10770 10767 405d61 3 API calls 10766->10767 10768 403523 10767->10768 10771 405d61 3 API calls 10768->10771 10899 405617 10769->10899 10770->10752 10772 403458 CreateDirectoryA SetCurrentDirectoryA 10770->10772 10774 40352c 10771->10774 10775 40347a 10772->10775 10776 40346f 10772->10776 10778 40357a ExitWindowsEx 10774->10778 10784 40353a GetCurrentProcess 10774->10784 10920 405a43 lstrcpynA 10775->10920 10919 405a43 lstrcpynA 10776->10919 10778->10760 10781 403587 10778->10781 10953 40140b 10781->10953 10789 40354a 10784->10789 10785 4033f2 10914 405a43 lstrcpynA 10785->10914 10787 405a65 18 API calls 10788 4034aa DeleteFileA 10787->10788 10790 4034b7 CopyFileA 10788->10790 10796 403488 10788->10796 10789->10778 10790->10796 10791 4034ff 10793 405791 39 API calls 10791->10793 10794 403506 10793->10794 10794->10752 10795 405a65 18 API calls 10795->10796 10796->10787 10796->10791 10796->10795 10798 4034eb CloseHandle 10796->10798 10921 405791 10796->10921 10950 4052a3 CreateProcessA 10796->10950 10798->10796 10800 405d88 GetProcAddress 10799->10800 10801 405d7d LoadLibraryA 10799->10801 10802 403268 SHGetFileInfoA 10800->10802 10801->10800 10801->10802 10803 405a43 lstrcpynA 10802->10803 10803->10733 10804->10735 10806 405ca1 5 API calls 10805->10806 10808 4031fd 10806->10808 10807 403207 10807->10742 10808->10807 10956 405536 lstrlenA CharPrevA 10808->10956 10811 405749 2 API calls 10812 403223 10811->10812 10812->10742 10959 40571a GetFileAttributesA CreateFileA 10813->10959 10815 402c9e 10842 402cab 10815->10842 10960 405a43 lstrcpynA 10815->10960 10817 402cc1 10961 40557d lstrlenA 10817->10961 10821 402cd2 GetFileSize 10822 402dd3 10821->10822 10840 402ce9 10821->10840 10968 402bc5 10822->10968 10826 402e16 GlobalAlloc 10830 402e2d 10826->10830 10827 402e6e 10828 402bc5 32 API calls 10827->10828 10828->10842 10832 405749 2 API calls 10830->10832 10831 402df7 10833 4031a8 ReadFile 10831->10833 10835 402e3e CreateFileA 10832->10835 10836 402e02 10833->10836 10834 402bc5 32 API calls 10834->10840 10837 402e78 10835->10837 10835->10842 10836->10826 10836->10842 10983 4031da SetFilePointer 10837->10983 10839 402e86 10984 402f01 10839->10984 10840->10822 10840->10827 10840->10834 10840->10842 10966 4031a8 ReadFile 10840->10966 10842->10751 10844 405d61 3 API calls 10843->10844 10845 4035f7 10844->10845 10846 4035fd 10845->10846 10847 40360f 10845->10847 11037 4059a1 wsprintfA 10846->11037 10848 40592a 3 API calls 10847->10848 10849 403630 10848->10849 10851 40364e lstrcatA 10849->10851 10853 40592a 3 API calls 10849->10853 10852 40360d 10851->10852 11028 403897 10852->11028 10853->10851 10856 405617 18 API calls 10858 403676 10856->10858 10857 4036ff 10859 405617 18 API calls 10857->10859 10858->10857 10860 40592a 3 API calls 10858->10860 10861 403705 10859->10861 10862 4036a2 10860->10862 10863 403715 LoadImageA 10861->10863 10864 405a65 18 API calls 10861->10864 10862->10857 10867 4036be lstrlenA 10862->10867 10871 405561 CharNextA 10862->10871 10865 403740 RegisterClassA 10863->10865 10866 4037c9 10863->10866 10864->10863 10868 40377c SystemParametersInfoA CreateWindowExA 10865->10868 10897 40340d 10865->10897 10869 40140b 2 API calls 10866->10869 10872 4036f2 10867->10872 10873 4036cc lstrcmpiA 10867->10873 10868->10866 10870 4037cf 10869->10870 10877 403897 19 API calls 10870->10877 10870->10897 10875 4036bc 10871->10875 10874 405536 3 API calls 10872->10874 10873->10872 10876 4036dc GetFileAttributesA 10873->10876 10878 4036f8 10874->10878 10875->10867 10879 4036e8 10876->10879 10881 4037e0 10877->10881 11038 405a43 lstrcpynA 10878->11038 10879->10872 10880 40557d 2 API calls 10879->10880 10880->10872 10883 403864 10881->10883 10884 4037e8 ShowWindow LoadLibraryA 10881->10884 11039 404eb3 OleInitialize 10883->11039 10885 403807 LoadLibraryA 10884->10885 10886 40380e GetClassInfoA 10884->10886 10885->10886 10888 403822 GetClassInfoA RegisterClassA 10886->10888 10889 403838 DialogBoxParamA 10886->10889 10888->10889 10891 40140b 2 API calls 10889->10891 10890 40386a 10892 403886 10890->10892 10893 40386e 10890->10893 10895 403860 10891->10895 10894 40140b 2 API calls 10892->10894 10896 40140b 2 API calls 10893->10896 10893->10897 10894->10897 10895->10897 10896->10897 10897->10752 10898->10740 11054 405a43 lstrcpynA 10899->11054 10901 405628 11055 4055ca CharNextA CharNextA 10901->11055 10904 4033e3 10904->10752 10913 405a43 lstrcpynA 10904->10913 10905 405ca1 5 API calls 10911 40563e 10905->10911 10906 405669 lstrlenA 10907 405674 10906->10907 10906->10911 10909 405536 3 API calls 10907->10909 10908 405d3a 2 API calls 10908->10911 10910 405679 GetFileAttributesA 10909->10910 10910->10904 10911->10904 10911->10906 10911->10908 10912 40557d 2 API calls 10911->10912 10912->10906 10913->10785 10914->10754 10917 405319 10915->10917 10916 403434 ExitProcess 10917->10916 10918 40532d MessageBoxIndirectA 10917->10918 10918->10916 10919->10775 10920->10796 10922 405d61 3 API calls 10921->10922 10923 40579c 10922->10923 10924 4057a4 MoveFileExA 10923->10924 10925 4057b5 10923->10925 10924->10925 10926 4058ee 10924->10926 10927 4057d3 10925->10927 10928 4057f9 GetShortPathNameA 10925->10928 10926->10796 11061 40571a GetFileAttributesA CreateFileA 10927->11061 10928->10926 10929 40580e 10928->10929 10929->10926 10932 405816 wsprintfA 10929->10932 10931 4057dd CloseHandle GetShortPathNameA 10931->10926 10933 4057f1 10931->10933 10934 405a65 18 API calls 10932->10934 10933->10926 10933->10928 10935 40583e 10934->10935 11062 40571a GetFileAttributesA CreateFileA 10935->11062 10937 40584b 10937->10926 10938 40585a GetFileSize GlobalAlloc 10937->10938 10939 4058e7 CloseHandle 10938->10939 10940 405878 ReadFile 10938->10940 10939->10926 10940->10939 10941 40588c 10940->10941 10941->10939 11063 40568f lstrlenA 10941->11063 10944 4058a1 11068 405a43 lstrcpynA 10944->11068 10945 4058fb 10947 40568f 4 API calls 10945->10947 10948 4058af 10947->10948 10949 4058c2 SetFilePointer WriteFile GlobalFree 10948->10949 10949->10939 10951 4052d2 CloseHandle 10950->10951 10952 4052de 10950->10952 10951->10952 10952->10796 10954 401389 2 API calls 10953->10954 10955 401420 10954->10955 10955->10760 10957 405550 lstrcatA 10956->10957 10958 40320f CreateDirectoryA 10956->10958 10957->10958 10958->10811 10959->10815 10960->10817 10962 40558a 10961->10962 10963 402cc7 10962->10963 10964 40558f CharPrevA 10962->10964 10965 405a43 lstrcpynA 10963->10965 10964->10962 10964->10963 10965->10821 10967 4031c9 10966->10967 10967->10840 10969 402bd3 10968->10969 10970 402beb 10968->10970 10971 402bdc DestroyWindow 10969->10971 10974 402be3 10969->10974 10972 402bf3 10970->10972 10973 402bfb GetTickCount 10970->10973 10971->10974 11000 405d9a 10972->11000 10973->10974 10976 402c09 10973->10976 10974->10826 10974->10842 10999 4031da SetFilePointer 10974->10999 10977 402c11 10976->10977 10978 402c3e CreateDialogParamA 10976->10978 10977->10974 11004 402ba9 10977->11004 10978->10974 10980 402c1f wsprintfA 10981 404de1 25 API calls 10980->10981 10982 402c3c 10981->10982 10982->10974 10983->10839 10985 402f12 SetFilePointer 10984->10985 10986 402f2e 10984->10986 10985->10986 11007 40302c GetTickCount 10986->11007 10989 402f3f ReadFile 10990 402f5f 10989->10990 10998 402feb 10989->10998 10991 40302c 42 API calls 10990->10991 10990->10998 10992 402f76 10991->10992 10993 402ff1 ReadFile 10992->10993 10995 402f86 10992->10995 10992->10998 10993->10998 10996 402fa1 ReadFile 10995->10996 10997 402fba WriteFile 10995->10997 10995->10998 10996->10995 10996->10998 10997->10995 10997->10998 10998->10842 10999->10831 11001 405db7 PeekMessageA 11000->11001 11002 405dc7 11001->11002 11003 405dad DispatchMessageA 11001->11003 11002->10974 11003->11001 11005 402bb8 11004->11005 11006 402bba MulDiv 11004->11006 11005->11006 11006->10980 11008 403196 11007->11008 11009 40305b 11007->11009 11010 402bc5 32 API calls 11008->11010 11020 4031da SetFilePointer 11009->11020 11018 402f37 11010->11018 11012 403066 SetFilePointer 11016 40308b 11012->11016 11013 4031a8 ReadFile 11013->11016 11015 402bc5 32 API calls 11015->11016 11016->11013 11016->11015 11017 403120 WriteFile 11016->11017 11016->11018 11019 403177 SetFilePointer 11016->11019 11021 405e5b 11016->11021 11017->11016 11017->11018 11018->10989 11018->10998 11019->11008 11020->11012 11022 405e80 11021->11022 11023 405e88 11021->11023 11022->11016 11023->11022 11024 405f18 GlobalAlloc 11023->11024 11025 405f0f GlobalFree 11023->11025 11026 405f86 GlobalFree 11023->11026 11027 405f8f GlobalAlloc 11023->11027 11024->11022 11024->11023 11025->11024 11026->11027 11027->11022 11027->11023 11029 4038ab 11028->11029 11046 4059a1 wsprintfA 11029->11046 11031 40391c 11032 405a65 18 API calls 11031->11032 11033 403928 SetWindowTextA 11032->11033 11034 40365e 11033->11034 11035 403944 11033->11035 11034->10856 11035->11034 11036 405a65 18 API calls 11035->11036 11036->11035 11037->10852 11038->10857 11047 403e83 11039->11047 11041 404efd 11042 403e83 SendMessageA 11041->11042 11043 404f0f OleUninitialize 11042->11043 11043->10890 11044 404ed6 11044->11041 11050 401389 11044->11050 11046->11031 11048 403e9b 11047->11048 11049 403e8c SendMessageA 11047->11049 11048->11044 11049->11048 11052 401390 11050->11052 11051 4013fe 11051->11044 11052->11051 11053 4013cb MulDiv SendMessageA 11052->11053 11053->11052 11054->10901 11056 4055f0 11055->11056 11057 4055e4 11055->11057 11059 405561 CharNextA 11056->11059 11060 40560d 11056->11060 11057->11056 11058 4055eb CharNextA 11057->11058 11058->11060 11059->11056 11060->10904 11060->10905 11061->10931 11062->10937 11064 4056c5 lstrlenA 11063->11064 11065 4056a3 lstrcmpiA 11064->11065 11066 4056cf 11064->11066 11065->11066 11067 4056bc CharNextA 11065->11067 11066->10944 11066->10945 11067->11064 11068->10948 11216 3796314 11217 379631f 11216->11217 11218 3796324 11216->11218 11230 3799fa5 11217->11230 11222 379621e 11218->11222 11221 3796332 11223 379622a __commit 11222->11223 11227 37962c7 __commit 11223->11227 11228 3796277 ___DllMainCRTStartup 11223->11228 11234 37960e9 11223->11234 11225 37962a7 11226 37960e9 __CRT_INIT@12 156 API calls 11225->11226 11225->11227 11226->11227 11227->11221 11228->11225 11228->11227 11229 37960e9 __CRT_INIT@12 156 API calls 11228->11229 11229->11225 11231 3799fca 11230->11231 11232 3799fd7 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 11230->11232 11231->11232 11233 3799fce 11231->11233 11232->11233 11233->11218 11235 37960f8 11234->11235 11236 3796174 11234->11236 11284 3799d26 HeapCreate 11235->11284 11238 37961ab 11236->11238 11239 379617a 11236->11239 11240 3796209 11238->11240 11241 37961b0 11238->11241 11244 3796195 11239->11244 11249 3796103 11239->11249 11415 3799571 11239->11415 11240->11249 11470 37976a9 11240->11470 11418 379738f TlsGetValue 11241->11418 11244->11249 11252 3799822 __ioterm 68 API calls 11244->11252 11249->11228 11251 379610f __RTC_Initialize 11254 3796113 11251->11254 11261 379611f GetCommandLineA 11251->11261 11255 379619f 11252->11255 11376 3799d56 11254->11376 11258 37973c3 __mtterm 70 API calls 11255->11258 11256 37961cd 11429 3797314 TlsGetValue 11256->11429 11260 37961a4 11258->11260 11263 3799d56 __heap_term 4 API calls 11260->11263 11320 3799ba3 11261->11320 11263->11249 11267 3796139 11270 379613d 11267->11270 11393 3799ae8 11267->11393 11268 37961fd 11457 3796370 11268->11457 11269 37961e6 11439 3797400 11269->11439 11382 37973c3 11270->11382 11273 3796162 11273->11249 11276 37961ed GetCurrentThreadId 11276->11249 11277 3796149 11283 379615d 11277->11283 11361 3799870 11277->11361 11283->11273 11410 3799822 11283->11410 11285 37960fe 11284->11285 11285->11249 11286 3797717 GetModuleHandleW 11285->11286 11287 379772b 11286->11287 11288 3797732 11286->11288 11481 37992bb 11287->11481 11290 379789a 11288->11290 11291 379773c GetProcAddress GetProcAddress GetProcAddress GetProcAddress 11288->11291 11294 37973c3 __mtterm 70 API calls 11290->11294 11293 3797785 TlsAlloc 11291->11293 11296 379789f 11293->11296 11297 37977d3 TlsSetValue 11293->11297 11294->11296 11296->11251 11297->11296 11298 37977e4 11297->11298 11485 3799580 11298->11485 11303 3797299 __encode_pointer 6 API calls 11304 3797804 11303->11304 11305 3797299 __encode_pointer 6 API calls 11304->11305 11306 3797814 11305->11306 11307 3797299 __encode_pointer 6 API calls 11306->11307 11308 3797824 11307->11308 11502 379a198 11308->11502 11311 3797314 __decode_pointer 6 API calls 11312 3797845 11311->11312 11312->11290 11313 3799221 __calloc_crt 67 API calls 11312->11313 11314 379785e 11313->11314 11314->11290 11315 3797314 __decode_pointer 6 API calls 11314->11315 11316 3797878 11315->11316 11316->11290 11317 379787f 11316->11317 11318 3797400 __mtinit 67 API calls 11317->11318 11319 3797887 GetCurrentThreadId 11318->11319 11319->11296 11321 3799be0 11320->11321 11322 3799bc1 GetEnvironmentStringsW 11320->11322 11323 3799c79 11321->11323 11324 3799bc9 11321->11324 11322->11324 11325 3799bd5 GetLastError 11322->11325 11326 3799c82 GetEnvironmentStrings 11323->11326 11329 379612f 11323->11329 11327 3799c0b WideCharToMultiByte 11324->11327 11328 3799bfc GetEnvironmentStringsW 11324->11328 11325->11321 11326->11329 11330 3799c92 11326->11330 11333 3799c3f 11327->11333 11334 3799c6e FreeEnvironmentStringsW 11327->11334 11328->11327 11328->11329 11346 37995ce 11329->11346 11335 37991dc __malloc_crt 67 API calls 11330->11335 11517 37991dc 11333->11517 11334->11329 11337 3799cac 11335->11337 11339 3799cbf ___crtGetEnvironmentStringsA 11337->11339 11340 3799cb3 FreeEnvironmentStringsA 11337->11340 11344 3799cc9 FreeEnvironmentStringsA 11339->11344 11340->11329 11341 3799c4d WideCharToMultiByte 11342 3799c67 11341->11342 11343 3799c5f 11341->11343 11342->11334 11345 3796370 type_info::_Type_info_dtor 67 API calls 11343->11345 11344->11329 11345->11342 11753 3799f4c 11346->11753 11348 37995da GetStartupInfoA 11349 3799221 __calloc_crt 67 API calls 11348->11349 11352 37995fb 11349->11352 11350 3799819 __commit 11350->11267 11351 3799796 GetStdHandle 11353 3799760 11351->11353 11352->11350 11352->11353 11354 3799221 __calloc_crt 67 API calls 11352->11354 11360 37996e3 11352->11360 11353->11350 11353->11351 11355 37997fb SetHandleCount 11353->11355 11356 37997a8 GetFileType 11353->11356 11358 379d424 ___lock_fhandle InitializeCriticalSectionAndSpinCount 11353->11358 11354->11352 11355->11350 11356->11353 11357 379970c GetFileType 11357->11360 11358->11353 11359 379d424 ___lock_fhandle InitializeCriticalSectionAndSpinCount 11359->11360 11360->11350 11360->11353 11360->11357 11360->11359 11362 3799879 11361->11362 11366 379987e _strlen 11361->11366 11754 3796f56 11362->11754 11364 3796152 11364->11283 11404 37993aa 11364->11404 11365 3799221 __calloc_crt 67 API calls 11370 37998b3 _strlen 11365->11370 11366->11364 11366->11365 11367 3799911 11368 3796370 type_info::_Type_info_dtor 67 API calls 11367->11368 11368->11364 11369 3799221 __calloc_crt 67 API calls 11369->11370 11370->11364 11370->11367 11370->11369 11371 3799937 11370->11371 11373 37978a4 _strcpy_s 67 API calls 11370->11373 11374 37998f8 11370->11374 11372 3796370 type_info::_Type_info_dtor 67 API calls 11371->11372 11372->11364 11373->11370 11374->11370 11375 37965b2 __invoke_watson 10 API calls 11374->11375 11375->11374 11377 3799d5f 11376->11377 11378 3799db6 HeapDestroy 11376->11378 11379 3799da4 HeapFree 11377->11379 11380 3799d7b VirtualFree HeapFree 11377->11380 11378->11249 11379->11378 11380->11380 11381 3799da3 11380->11381 11381->11379 11383 37973cd 11382->11383 11384 37973d9 11382->11384 11385 3797314 __decode_pointer 6 API calls 11383->11385 11386 37973ed TlsFree 11384->11386 11387 37973fb 11384->11387 11385->11384 11386->11387 11388 379a1ff DeleteCriticalSection 11387->11388 11389 379a217 11387->11389 11390 3796370 type_info::_Type_info_dtor 67 API calls 11388->11390 11391 379a229 DeleteCriticalSection 11389->11391 11392 379a237 11389->11392 11390->11387 11391->11389 11392->11254 11394 3799afd 11393->11394 11395 3799b02 GetModuleFileNameA 11393->11395 11396 3796f56 ___initmbctable 111 API calls 11394->11396 11397 3799b29 11395->11397 11396->11395 12052 379994e 11397->12052 11400 37991dc __malloc_crt 67 API calls 11401 3799b6b 11400->11401 11402 379994e _parse_cmdline 77 API calls 11401->11402 11403 3799b85 11401->11403 11402->11403 11403->11277 11405 37993b8 __IsNonwritableInCurrentImage 11404->11405 12064 379b8e4 11405->12064 11407 37993d6 __initterm_e 11409 37993f5 __IsNonwritableInCurrentImage __initterm 11407->11409 12068 37983f0 11407->12068 11409->11283 11411 379982b 11410->11411 11412 3796172 11411->11412 11413 379983f DeleteCriticalSection 11411->11413 11414 3796370 type_info::_Type_info_dtor 67 API calls 11411->11414 11412->11270 11413->11411 11414->11411 12168 379942f 11415->12168 11417 379957c 11417->11244 11419 37961b5 11418->11419 11420 37973a4 11418->11420 11423 3799221 11419->11423 11421 3797314 __decode_pointer 6 API calls 11420->11421 11422 37973af TlsSetValue 11421->11422 11422->11419 11425 379922a 11423->11425 11426 37961c1 11425->11426 11427 3799248 Sleep 11425->11427 12191 379ceac 11425->12191 11426->11249 11426->11256 11428 379925d 11427->11428 11428->11425 11428->11426 11430 379734d GetModuleHandleW 11429->11430 11431 379732c 11429->11431 11432 3797368 GetProcAddress 11430->11432 11433 379735d 11430->11433 11431->11430 11434 3797336 TlsGetValue 11431->11434 11437 37961df 11432->11437 11435 37992bb __crt_waiting_on_module_handle 2 API calls 11433->11435 11438 3797341 11434->11438 11436 3797363 11435->11436 11436->11432 11436->11437 11437->11268 11437->11269 11438->11430 11438->11437 12208 3799f4c 11439->12208 11441 379740c GetModuleHandleW 11442 379741c 11441->11442 11443 3797422 11441->11443 11444 37992bb __crt_waiting_on_module_handle 2 API calls 11442->11444 11445 379743a GetProcAddress GetProcAddress 11443->11445 11446 379745e 11443->11446 11444->11443 11445->11446 11447 379a314 __lock 63 API calls 11446->11447 11448 379747d InterlockedIncrement 11447->11448 12209 37974d5 11448->12209 11451 379a314 __lock 63 API calls 11452 379749e 11451->11452 11453 37970bd ___addlocaleref 8 API calls 11452->11453 11454 37974bc 11453->11454 12212 37974de 11454->12212 11456 37974c9 __commit 11456->11276 11458 379637c __commit 11457->11458 11459 37963bb 11458->11459 11461 379a314 __lock 65 API calls 11458->11461 11467 37963f5 __commit __dosmaperr 11458->11467 11460 37963d0 HeapFree 11459->11460 11459->11467 11462 37963e2 11460->11462 11460->11467 11466 3796393 ___sbh_find_block 11461->11466 11463 3796742 __commit 65 API calls 11462->11463 11464 37963e7 GetLastError 11463->11464 11464->11467 11465 37963ad 12224 37963c6 11465->12224 11466->11465 12217 379a377 11466->12217 11467->11273 11471 3797702 11470->11471 11472 37976b7 11470->11472 11475 379770c TlsSetValue 11471->11475 11476 3797715 11471->11476 11473 37976bd TlsGetValue 11472->11473 11474 37976e0 11472->11474 11473->11474 11477 37976d0 TlsGetValue 11473->11477 11478 3797314 __decode_pointer 6 API calls 11474->11478 11475->11476 11476->11249 11477->11474 11479 37976f7 11478->11479 12232 379757a 11479->12232 11482 37992c6 Sleep GetModuleHandleW 11481->11482 11483 3797731 11482->11483 11484 37992e4 11482->11484 11483->11288 11484->11482 11484->11483 11506 379730b 11485->11506 11487 3799588 __init_pointers __initp_misc_winsig 11509 379917b 11487->11509 11490 3797299 __encode_pointer 6 API calls 11491 37977e9 11490->11491 11492 3797299 TlsGetValue 11491->11492 11493 37972b1 11492->11493 11494 37972d2 GetModuleHandleW 11492->11494 11493->11494 11495 37972bb TlsGetValue 11493->11495 11496 37972ed GetProcAddress 11494->11496 11497 37972e2 11494->11497 11499 37972c6 11495->11499 11501 37972ca 11496->11501 11498 37992bb __crt_waiting_on_module_handle 2 API calls 11497->11498 11500 37972e8 11498->11500 11499->11494 11499->11501 11500->11496 11500->11501 11501->11303 11505 379a1a3 11502->11505 11504 3797831 11504->11290 11504->11311 11505->11504 11512 379d424 11505->11512 11507 3797299 __encode_pointer 6 API calls 11506->11507 11508 3797312 11507->11508 11508->11487 11510 3797299 __encode_pointer 6 API calls 11509->11510 11511 3799185 11510->11511 11511->11490 11516 3799f4c 11512->11516 11514 379d430 InitializeCriticalSectionAndSpinCount 11515 379d474 __commit 11514->11515 11515->11505 11516->11514 11520 37991e5 11517->11520 11519 379921b 11519->11334 11519->11341 11520->11519 11521 37991fc Sleep 11520->11521 11522 379795b 11520->11522 11521->11520 11523 3797a0e 11522->11523 11532 379796d 11522->11532 11524 3798416 _malloc 6 API calls 11523->11524 11525 3797a14 11524->11525 11527 3796742 __commit 66 API calls 11525->11527 11538 3797a06 11527->11538 11530 37979ca HeapAlloc 11530->11532 11532->11530 11533 37979fa 11532->11533 11536 37979ff 11532->11536 11532->11538 11539 379c5cb 11532->11539 11548 379c420 11532->11548 11582 379933f 11532->11582 11585 379790c 11532->11585 11593 3798416 11532->11593 11596 3796742 11533->11596 11537 3796742 __commit 66 API calls 11536->11537 11537->11538 11538->11520 11599 379ddcd 11539->11599 11542 379ddcd __set_error_mode 67 API calls 11544 379c5df 11542->11544 11543 379c420 __NMSG_WRITE 67 API calls 11545 379c5f7 11543->11545 11544->11543 11546 379c601 11544->11546 11547 379c420 __NMSG_WRITE 67 API calls 11545->11547 11546->11532 11547->11546 11549 379c434 11548->11549 11550 379ddcd __set_error_mode 64 API calls 11549->11550 11581 379c58f 11549->11581 11551 379c456 11550->11551 11552 379c594 GetStdHandle 11551->11552 11554 379ddcd __set_error_mode 64 API calls 11551->11554 11553 379c5a2 _strlen 11552->11553 11552->11581 11557 379c5bb WriteFile 11553->11557 11553->11581 11555 379c467 11554->11555 11555->11552 11556 379c479 11555->11556 11556->11581 11608 37978a4 11556->11608 11557->11581 11560 379c4af GetModuleFileNameA 11562 379c4cd 11560->11562 11569 379c4f0 _strlen 11560->11569 11564 37978a4 _strcpy_s 64 API calls 11562->11564 11565 379c4dd 11564->11565 11567 37965b2 __invoke_watson 10 API calls 11565->11567 11565->11569 11566 379c533 11633 379bef1 11566->11633 11567->11569 11569->11566 11624 379bfb6 11569->11624 11572 379c557 11575 379bef1 _strcat_s 64 API calls 11572->11575 11574 37965b2 __invoke_watson 10 API calls 11574->11572 11576 379c56b 11575->11576 11578 379c57c 11576->11578 11579 37965b2 __invoke_watson 10 API calls 11576->11579 11577 37965b2 __invoke_watson 10 API calls 11577->11566 11642 379dc64 11578->11642 11579->11578 11581->11532 11671 3799314 GetModuleHandleW 11582->11671 11586 3797918 __commit 11585->11586 11588 3797949 __commit 11586->11588 11674 379a314 11586->11674 11588->11532 11589 379792e 11681 379ab26 11589->11681 11594 3797314 __decode_pointer 6 API calls 11593->11594 11595 3798426 11594->11595 11595->11532 11739 37974e7 GetLastError 11596->11739 11598 3796747 11598->11536 11600 379dddc 11599->11600 11601 3796742 __commit 67 API calls 11600->11601 11602 379c5d2 11600->11602 11603 379ddff 11601->11603 11602->11542 11602->11544 11605 37966da 11603->11605 11606 3797314 __decode_pointer 6 API calls 11605->11606 11607 37966ea __invoke_watson 11606->11607 11609 37978bc 11608->11609 11610 37978b5 11608->11610 11611 3796742 __commit 67 API calls 11609->11611 11610->11609 11615 37978e2 11610->11615 11612 37978c1 11611->11612 11613 37966da __commit 6 API calls 11612->11613 11614 37978d0 11613->11614 11614->11560 11617 37965b2 11614->11617 11615->11614 11616 3796742 __commit 67 API calls 11615->11616 11616->11612 11669 3795720 11617->11669 11619 37965df IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 11620 37966bb GetCurrentProcess TerminateProcess 11619->11620 11623 37966af __invoke_watson 11619->11623 11621 379579a __fltout2 5 API calls 11620->11621 11622 37966d8 11621->11622 11622->11560 11623->11620 11628 379bfc8 11624->11628 11625 379bfcc 11626 379bfd1 11625->11626 11627 3796742 __commit 67 API calls 11625->11627 11626->11566 11626->11577 11629 379bfe8 11627->11629 11628->11625 11628->11626 11631 379c012 11628->11631 11630 37966da __commit 6 API calls 11629->11630 11630->11626 11631->11626 11632 3796742 __commit 67 API calls 11631->11632 11632->11629 11634 379bf09 11633->11634 11637 379bf02 11633->11637 11635 3796742 __commit 67 API calls 11634->11635 11636 379bf0e 11635->11636 11638 37966da __commit 6 API calls 11636->11638 11637->11634 11640 379bf3d 11637->11640 11639 379bf1d 11638->11639 11639->11572 11639->11574 11640->11639 11641 3796742 __commit 67 API calls 11640->11641 11641->11636 11643 379730b FindHandlerForForeignException 6 API calls 11642->11643 11644 379dc74 11643->11644 11645 379dc87 LoadLibraryA 11644->11645 11647 379dd0f 11644->11647 11646 379dc9c GetProcAddress 11645->11646 11658 379ddb1 11645->11658 11648 379dcb2 11646->11648 11646->11658 11651 3797314 __decode_pointer 6 API calls 11647->11651 11665 379dd39 11647->11665 11652 3797299 __encode_pointer 6 API calls 11648->11652 11649 3797314 __decode_pointer 6 API calls 11649->11658 11650 3797314 __decode_pointer 6 API calls 11662 379dd7c 11650->11662 11653 379dd2c 11651->11653 11654 379dcb8 GetProcAddress 11652->11654 11655 3797314 __decode_pointer 6 API calls 11653->11655 11656 3797299 __encode_pointer 6 API calls 11654->11656 11655->11665 11657 379dccd GetProcAddress 11656->11657 11659 3797299 __encode_pointer 6 API calls 11657->11659 11658->11581 11660 379dce2 GetProcAddress 11659->11660 11661 3797299 __encode_pointer 6 API calls 11660->11661 11663 379dcf7 11661->11663 11664 3797314 __decode_pointer 6 API calls 11662->11664 11667 379dd64 11662->11667 11663->11647 11666 379dd01 GetProcAddress 11663->11666 11664->11667 11665->11650 11665->11667 11668 3797299 __encode_pointer 6 API calls 11666->11668 11667->11649 11668->11647 11670 379572c __VEC_memzero 11669->11670 11670->11619 11672 3799328 GetProcAddress 11671->11672 11673 3799338 ExitProcess 11671->11673 11672->11673 11675 379a329 11674->11675 11676 379a33c EnterCriticalSection 11674->11676 11690 379a251 11675->11690 11676->11589 11678 379a32f 11678->11676 11716 37992eb 11678->11716 11683 379ab54 11681->11683 11682 379abed 11686 3797939 11682->11686 11734 379a73d 11682->11734 11683->11682 11683->11686 11727 379a68d 11683->11727 11687 3797952 11686->11687 11738 379a23a LeaveCriticalSection 11687->11738 11689 3797959 11689->11588 11691 379a25d __commit 11690->11691 11692 379a283 11691->11692 11693 379c5cb __FF_MSGBANNER 67 API calls 11691->11693 11694 37991dc __malloc_crt 67 API calls 11692->11694 11700 379a293 __commit 11692->11700 11695 379a272 11693->11695 11696 379a29e 11694->11696 11697 379c420 __NMSG_WRITE 67 API calls 11695->11697 11698 379a2a5 11696->11698 11699 379a2b4 11696->11699 11701 379a279 11697->11701 11702 3796742 __commit 67 API calls 11698->11702 11703 379a314 __lock 67 API calls 11699->11703 11700->11678 11704 379933f _malloc 3 API calls 11701->11704 11702->11700 11705 379a2bb 11703->11705 11704->11692 11706 379a2ef 11705->11706 11707 379a2c3 11705->11707 11708 3796370 type_info::_Type_info_dtor 67 API calls 11706->11708 11709 379d424 ___lock_fhandle InitializeCriticalSectionAndSpinCount 11707->11709 11710 379a2e0 11708->11710 11711 379a2ce 11709->11711 11723 379a30b 11710->11723 11711->11710 11713 3796370 type_info::_Type_info_dtor 67 API calls 11711->11713 11714 379a2da 11713->11714 11715 3796742 __commit 67 API calls 11714->11715 11715->11710 11717 379c5cb __FF_MSGBANNER 67 API calls 11716->11717 11718 37992f5 11717->11718 11719 379c420 __NMSG_WRITE 67 API calls 11718->11719 11720 37992fd 11719->11720 11721 3797314 __decode_pointer 6 API calls 11720->11721 11722 3799308 11721->11722 11722->11676 11726 379a23a LeaveCriticalSection 11723->11726 11725 379a312 11725->11700 11726->11725 11728 379a6a0 HeapReAlloc 11727->11728 11729 379a6d4 HeapAlloc 11727->11729 11730 379a6c2 11728->11730 11733 379a6be 11728->11733 11731 379a6f7 VirtualAlloc 11729->11731 11729->11733 11730->11729 11732 379a711 HeapFree 11731->11732 11731->11733 11732->11733 11733->11682 11735 379a754 VirtualAlloc 11734->11735 11737 379a79b 11735->11737 11737->11686 11738->11689 11740 379738f ___set_flsgetvalue 8 API calls 11739->11740 11741 37974fe 11740->11741 11742 3797554 SetLastError 11741->11742 11743 3799221 __calloc_crt 64 API calls 11741->11743 11742->11598 11744 3797512 11743->11744 11744->11742 11745 3797314 __decode_pointer 6 API calls 11744->11745 11746 379752c 11745->11746 11747 379754b 11746->11747 11748 3797533 11746->11748 11750 3796370 type_info::_Type_info_dtor 64 API calls 11747->11750 11749 3797400 __mtinit 64 API calls 11748->11749 11751 379753b GetCurrentThreadId 11749->11751 11752 3797551 11750->11752 11751->11742 11752->11742 11753->11348 11755 3796f5f 11754->11755 11756 3796f66 11754->11756 11758 3796dbc 11755->11758 11756->11366 11759 3796dc8 __commit 11758->11759 11789 3797560 11759->11789 11763 3796ddb 11810 3796b5b 11763->11810 11766 37991dc __malloc_crt 67 API calls 11767 3796dfc 11766->11767 11768 3796f1b __commit 11767->11768 11817 3796bd7 11767->11817 11768->11756 11771 3796f28 11771->11768 11775 3796370 type_info::_Type_info_dtor 67 API calls 11771->11775 11779 3796f3b 11771->11779 11772 3796e2c InterlockedDecrement 11773 3796e4d InterlockedIncrement 11772->11773 11774 3796e3c 11772->11774 11773->11768 11778 3796e63 11773->11778 11774->11773 11777 3796370 type_info::_Type_info_dtor 67 API calls 11774->11777 11775->11779 11776 3796742 __commit 67 API calls 11776->11768 11780 3796e4c 11777->11780 11778->11768 11781 379a314 __lock 67 API calls 11778->11781 11779->11776 11780->11773 11783 3796e77 InterlockedDecrement 11781->11783 11784 3796ef3 11783->11784 11785 3796f06 InterlockedIncrement 11783->11785 11784->11785 11787 3796370 type_info::_Type_info_dtor 67 API calls 11784->11787 11827 3796f1d 11785->11827 11788 3796f05 11787->11788 11788->11785 11790 37974e7 __getptd_noexit 67 API calls 11789->11790 11791 3797568 11790->11791 11792 37992eb __amsg_exit 67 API calls 11791->11792 11793 3796dd1 11791->11793 11792->11793 11794 3796ab7 11793->11794 11795 3796ac3 __commit 11794->11795 11796 3797560 __getptd 67 API calls 11795->11796 11797 3796ac8 11796->11797 11798 379a314 __lock 67 API calls 11797->11798 11805 3796ada 11797->11805 11799 3796af8 11798->11799 11800 3796b41 11799->11800 11801 3796b29 InterlockedIncrement 11799->11801 11802 3796b0f InterlockedDecrement 11799->11802 11830 3796b52 11800->11830 11801->11800 11802->11801 11807 3796b1a 11802->11807 11804 37992eb __amsg_exit 67 API calls 11806 3796ae8 __commit 11804->11806 11805->11804 11805->11806 11806->11763 11807->11801 11808 3796370 type_info::_Type_info_dtor 67 API calls 11807->11808 11809 3796b28 11808->11809 11809->11801 11834 379582b 11810->11834 11813 3796b98 11815 3796b9d GetACP 11813->11815 11816 3796b8a 11813->11816 11814 3796b7a GetOEMCP 11814->11816 11815->11816 11816->11766 11816->11768 11818 3796b5b getSystemCP 79 API calls 11817->11818 11819 3796bf7 11818->11819 11820 3796c02 setSBCS 11819->11820 11823 3796c46 IsValidCodePage 11819->11823 11825 3796c6b _memset __setmbcp_nolock 11819->11825 11821 379579a __fltout2 5 API calls 11820->11821 11822 3796dba 11821->11822 11822->11771 11822->11772 11823->11820 11824 3796c58 GetCPInfo 11823->11824 11824->11820 11824->11825 11925 3796924 GetCPInfo 11825->11925 12051 379a23a LeaveCriticalSection 11827->12051 11829 3796f24 11829->11768 11833 379a23a LeaveCriticalSection 11830->11833 11832 3796b59 11832->11805 11833->11832 11835 379583e 11834->11835 11839 379588b 11834->11839 11836 3797560 __getptd 67 API calls 11835->11836 11837 3795843 11836->11837 11838 379586b 11837->11838 11842 3797223 11837->11842 11838->11839 11841 3796ab7 _LocaleUpdate::_LocaleUpdate 69 API calls 11838->11841 11839->11813 11839->11814 11841->11839 11843 379722f __commit 11842->11843 11844 3797560 __getptd 67 API calls 11843->11844 11845 3797234 11844->11845 11846 3797262 11845->11846 11847 3797246 11845->11847 11848 379a314 __lock 67 API calls 11846->11848 11849 3797560 __getptd 67 API calls 11847->11849 11850 3797269 11848->11850 11855 379724b 11849->11855 11857 37971e5 11850->11857 11854 3797259 __commit 11854->11838 11855->11854 11856 37992eb __amsg_exit 67 API calls 11855->11856 11856->11854 11858 37971e9 11857->11858 11859 379721b 11857->11859 11858->11859 11868 37970bd InterlockedIncrement 11858->11868 11865 379728d 11859->11865 11861 37971fc 11861->11859 11880 379714c 11861->11880 11924 379a23a LeaveCriticalSection 11865->11924 11867 3797294 11867->11855 11869 37970db InterlockedIncrement 11868->11869 11870 37970de 11868->11870 11869->11870 11871 37970e8 InterlockedIncrement 11870->11871 11872 37970eb 11870->11872 11871->11872 11873 37970f8 11872->11873 11874 37970f5 InterlockedIncrement 11872->11874 11875 3797102 InterlockedIncrement 11873->11875 11877 3797105 11873->11877 11874->11873 11875->11877 11876 379711e InterlockedIncrement 11876->11877 11877->11876 11878 379712e InterlockedIncrement 11877->11878 11879 3797139 InterlockedIncrement 11877->11879 11878->11877 11879->11861 11881 379715d InterlockedDecrement 11880->11881 11882 37971e0 11880->11882 11883 3797172 InterlockedDecrement 11881->11883 11884 3797175 11881->11884 11882->11859 11894 3796f74 11882->11894 11883->11884 11885 379717f InterlockedDecrement 11884->11885 11886 3797182 11884->11886 11885->11886 11887 379718c InterlockedDecrement 11886->11887 11888 379718f 11886->11888 11887->11888 11889 3797199 InterlockedDecrement 11888->11889 11891 379719c 11888->11891 11889->11891 11890 37971b5 InterlockedDecrement 11890->11891 11891->11890 11892 37971c5 InterlockedDecrement 11891->11892 11893 37971d0 InterlockedDecrement 11891->11893 11892->11891 11893->11882 11895 3796ff8 11894->11895 11896 3796f8b 11894->11896 11897 3797045 11895->11897 11898 3796370 type_info::_Type_info_dtor 67 API calls 11895->11898 11896->11895 11903 3796fbf 11896->11903 11907 3796370 type_info::_Type_info_dtor 67 API calls 11896->11907 11899 379bc89 ___free_lc_time 67 API calls 11897->11899 11914 379706c 11897->11914 11900 3797019 11898->11900 11902 3797065 11899->11902 11901 3796370 type_info::_Type_info_dtor 67 API calls 11900->11901 11904 379702c 11901->11904 11908 3796370 type_info::_Type_info_dtor 67 API calls 11902->11908 11909 3796370 type_info::_Type_info_dtor 67 API calls 11903->11909 11923 3796fe0 11903->11923 11910 3796370 type_info::_Type_info_dtor 67 API calls 11904->11910 11905 3796370 type_info::_Type_info_dtor 67 API calls 11911 3796fed 11905->11911 11906 37970b1 11912 3796370 type_info::_Type_info_dtor 67 API calls 11906->11912 11913 3796fb4 11907->11913 11908->11914 11915 3796fd5 11909->11915 11916 379703a 11910->11916 11918 3796370 type_info::_Type_info_dtor 67 API calls 11911->11918 11919 37970b7 11912->11919 11920 379be63 ___free_lconv_mon 67 API calls 11913->11920 11914->11906 11917 3796370 67 API calls type_info::_Type_info_dtor 11914->11917 11921 379be1e ___free_lconv_num 67 API calls 11915->11921 11922 3796370 type_info::_Type_info_dtor 67 API calls 11916->11922 11917->11914 11918->11895 11919->11859 11920->11903 11921->11923 11922->11897 11923->11905 11924->11867 11927 3796958 _memset 11925->11927 11934 3796a0a 11925->11934 11935 379bc47 11927->11935 11930 379579a __fltout2 5 API calls 11931 3796ab5 11930->11931 11931->11825 11933 3797dca ___crtLCMapStringA 102 API calls 11933->11934 11934->11930 11936 379582b _LocaleUpdate::_LocaleUpdate 77 API calls 11935->11936 11937 379bc5a 11936->11937 11945 379ba8d 11937->11945 11940 3797dca 11941 379582b _LocaleUpdate::_LocaleUpdate 77 API calls 11940->11941 11942 3797ddd 11941->11942 12004 3797a25 11942->12004 11946 379bad9 11945->11946 11947 379baae GetStringTypeW 11945->11947 11949 379bac6 11946->11949 11950 379bbc0 11946->11950 11948 379bace GetLastError 11947->11948 11947->11949 11948->11946 11951 379bb12 MultiByteToWideChar 11949->11951 11959 379bbba 11949->11959 11973 379c604 GetLocaleInfoA 11950->11973 11953 379bb3f 11951->11953 11951->11959 11960 379795b _malloc 67 API calls 11953->11960 11968 379bb54 _memset __alloca_probe_16 11953->11968 11954 379579a __fltout2 5 API calls 11955 37969c5 11954->11955 11955->11940 11957 379bc11 GetStringTypeA 11958 379bc2c 11957->11958 11957->11959 11965 3796370 type_info::_Type_info_dtor 67 API calls 11958->11965 11959->11954 11960->11968 11962 379bb8d MultiByteToWideChar 11963 379bba3 GetStringTypeW 11962->11963 11964 379bbb4 11962->11964 11963->11964 11969 379580b 11964->11969 11965->11959 11968->11959 11968->11962 11970 3795828 11969->11970 11971 3795817 11969->11971 11970->11959 11971->11970 11972 3796370 type_info::_Type_info_dtor 67 API calls 11971->11972 11972->11970 11974 379c632 11973->11974 11975 379c637 11973->11975 11977 379579a __fltout2 5 API calls 11974->11977 11976 379dc4e ___ansicp 90 API calls 11975->11976 11976->11974 11978 379bbe4 11977->11978 11978->11957 11978->11959 11979 379c64d 11978->11979 11980 379c68d GetCPInfo 11979->11980 11984 379c717 11979->11984 11981 379c702 MultiByteToWideChar 11980->11981 11982 379c6a4 11980->11982 11981->11984 11988 379c6bd _strlen 11981->11988 11982->11981 11985 379c6aa GetCPInfo 11982->11985 11983 379579a __fltout2 5 API calls 11986 379bc05 11983->11986 11984->11983 11985->11981 11987 379c6b7 11985->11987 11986->11957 11986->11959 11987->11981 11987->11988 11989 379c6ef _memset __alloca_probe_16 11988->11989 11990 379795b _malloc 67 API calls 11988->11990 11989->11984 11991 379c74c MultiByteToWideChar 11989->11991 11990->11989 11992 379c783 11991->11992 11993 379c764 11991->11993 11994 379580b __freea 67 API calls 11992->11994 11995 379c788 11993->11995 11996 379c76b WideCharToMultiByte 11993->11996 11994->11984 11997 379c793 WideCharToMultiByte 11995->11997 11998 379c7a7 11995->11998 11996->11992 11997->11992 11997->11998 11999 3799221 __calloc_crt 67 API calls 11998->11999 12000 379c7af 11999->12000 12000->11992 12001 379c7b8 WideCharToMultiByte 12000->12001 12001->11992 12002 379c7ca 12001->12002 12003 3796370 type_info::_Type_info_dtor 67 API calls 12002->12003 12003->11992 12005 3797a46 LCMapStringW 12004->12005 12008 3797a61 12004->12008 12006 3797a69 GetLastError 12005->12006 12005->12008 12006->12008 12007 3797c5f 12011 379c604 ___ansicp 91 API calls 12007->12011 12008->12007 12009 3797abb 12008->12009 12010 3797c56 12009->12010 12012 3797ad4 MultiByteToWideChar 12009->12012 12014 379579a __fltout2 5 API calls 12010->12014 12013 3797c87 12011->12013 12012->12010 12018 3797b01 12012->12018 12013->12010 12016 3797d7b LCMapStringA 12013->12016 12017 3797ca0 12013->12017 12015 37969e5 12014->12015 12015->11933 12050 3797cd7 12016->12050 12019 379c64d ___convertcp 74 API calls 12017->12019 12022 379795b _malloc 67 API calls 12018->12022 12030 3797b1a __alloca_probe_16 12018->12030 12023 3797cb2 12019->12023 12020 3797b52 MultiByteToWideChar 12024 3797b6b LCMapStringW 12020->12024 12045 3797c4d 12020->12045 12021 3797da2 12021->12010 12031 3796370 type_info::_Type_info_dtor 67 API calls 12021->12031 12022->12030 12023->12010 12026 3797cbc LCMapStringA 12023->12026 12028 3797b8c 12024->12028 12024->12045 12025 3796370 type_info::_Type_info_dtor 67 API calls 12025->12021 12034 3797cde 12026->12034 12026->12050 12027 379580b __freea 67 API calls 12027->12010 12029 3797b95 12028->12029 12033 3797bbe 12028->12033 12032 3797ba7 LCMapStringW 12029->12032 12029->12045 12030->12010 12030->12020 12031->12010 12032->12045 12036 3797bd9 __alloca_probe_16 12033->12036 12041 379795b _malloc 67 API calls 12033->12041 12037 3797cef _memset __alloca_probe_16 12034->12037 12040 379795b _malloc 67 API calls 12034->12040 12035 3797c0d LCMapStringW 12038 3797c25 WideCharToMultiByte 12035->12038 12039 3797c47 12035->12039 12036->12035 12036->12045 12043 3797d2d LCMapStringA 12037->12043 12037->12050 12038->12039 12042 379580b __freea 67 API calls 12039->12042 12040->12037 12041->12036 12042->12045 12046 3797d49 12043->12046 12047 3797d4d 12043->12047 12045->12027 12049 379580b __freea 67 API calls 12046->12049 12048 379c64d ___convertcp 74 API calls 12047->12048 12048->12046 12049->12050 12050->12021 12050->12025 12051->11829 12054 379996d 12052->12054 12056 37999da 12054->12056 12058 379d4d7 12054->12058 12055 3799ad8 12055->11400 12055->11403 12056->12055 12057 379d4d7 77 API calls _parse_cmdline 12056->12057 12057->12056 12061 379d484 12058->12061 12062 379582b _LocaleUpdate::_LocaleUpdate 77 API calls 12061->12062 12063 379d497 12062->12063 12063->12054 12065 379b8ea 12064->12065 12066 3797299 __encode_pointer 6 API calls 12065->12066 12067 379b902 12065->12067 12066->12065 12067->11407 12071 37983b4 12068->12071 12070 37983fd 12070->11409 12072 37983c0 __commit 12071->12072 12079 3799357 12072->12079 12078 37983e1 __commit 12078->12070 12080 379a314 __lock 67 API calls 12079->12080 12081 37983c5 12080->12081 12082 37982c9 12081->12082 12083 3797314 __decode_pointer 6 API calls 12082->12083 12084 37982dd 12083->12084 12085 3797314 __decode_pointer 6 API calls 12084->12085 12086 37982ed 12085->12086 12087 3798370 12086->12087 12102 379c93b 12086->12102 12099 37983ea 12087->12099 12089 3798357 12090 3797299 __encode_pointer 6 API calls 12089->12090 12091 3798365 12090->12091 12094 3797299 __encode_pointer 6 API calls 12091->12094 12092 379832f 12092->12087 12096 379926d __realloc_crt 73 API calls 12092->12096 12097 3798345 12092->12097 12093 379830b 12093->12089 12093->12092 12115 379926d 12093->12115 12094->12087 12096->12097 12097->12087 12098 3797299 __encode_pointer 6 API calls 12097->12098 12098->12089 12164 3799360 12099->12164 12103 379c947 __commit 12102->12103 12104 379c974 12103->12104 12105 379c957 12103->12105 12107 379c9b5 HeapSize 12104->12107 12110 379a314 __lock 67 API calls 12104->12110 12106 3796742 __commit 67 API calls 12105->12106 12109 379c95c 12106->12109 12108 379c96c __commit 12107->12108 12108->12093 12111 37966da __commit 6 API calls 12109->12111 12112 379c984 ___sbh_find_block 12110->12112 12111->12108 12120 379c9d5 12112->12120 12117 3799276 12115->12117 12118 37992b5 12117->12118 12119 3799296 Sleep 12117->12119 12124 379cfca 12117->12124 12118->12092 12119->12117 12123 379a23a LeaveCriticalSection 12120->12123 12122 379c9b0 12122->12107 12122->12108 12123->12122 12125 379cfd6 __commit 12124->12125 12126 379cfeb 12125->12126 12127 379cfdd 12125->12127 12129 379cffe 12126->12129 12130 379cff2 12126->12130 12128 379795b _malloc 67 API calls 12127->12128 12136 379cfe5 __commit __dosmaperr 12128->12136 12137 379d170 12129->12137 12152 379d00b ___sbh_resize_block ___sbh_find_block ___crtGetEnvironmentStringsA 12129->12152 12131 3796370 type_info::_Type_info_dtor 67 API calls 12130->12131 12131->12136 12132 379d1a3 12135 3798416 _malloc 6 API calls 12132->12135 12133 379d175 HeapReAlloc 12133->12136 12133->12137 12134 379a314 __lock 67 API calls 12134->12152 12138 379d1a9 12135->12138 12136->12117 12137->12132 12137->12133 12139 379d1c7 12137->12139 12141 3798416 _malloc 6 API calls 12137->12141 12143 379d1bd 12137->12143 12140 3796742 __commit 67 API calls 12138->12140 12139->12136 12142 3796742 __commit 67 API calls 12139->12142 12140->12136 12141->12137 12144 379d1d0 GetLastError 12142->12144 12146 3796742 __commit 67 API calls 12143->12146 12144->12136 12158 379d13e 12146->12158 12147 379d096 HeapAlloc 12147->12152 12148 379d143 GetLastError 12148->12136 12149 379d0eb HeapReAlloc 12149->12152 12150 379ab26 ___sbh_alloc_block 5 API calls 12150->12152 12151 379d156 12151->12136 12154 3796742 __commit 67 API calls 12151->12154 12152->12132 12152->12134 12152->12136 12152->12147 12152->12149 12152->12150 12152->12151 12153 3798416 _malloc 6 API calls 12152->12153 12155 379d139 12152->12155 12159 379a377 VirtualFree VirtualFree HeapFree __VEC_memcpy ___sbh_free_block 12152->12159 12160 379d10e 12152->12160 12153->12152 12156 379d163 12154->12156 12157 3796742 __commit 67 API calls 12155->12157 12156->12136 12156->12144 12157->12158 12158->12136 12158->12148 12159->12152 12163 379a23a LeaveCriticalSection 12160->12163 12162 379d115 12162->12152 12163->12162 12167 379a23a LeaveCriticalSection 12164->12167 12166 37983ef 12166->12078 12167->12166 12169 379943b __commit 12168->12169 12170 379a314 __lock 67 API calls 12169->12170 12171 3799442 12170->12171 12174 3797314 __decode_pointer 6 API calls 12171->12174 12175 37994fb __initterm 12171->12175 12177 3799479 12174->12177 12185 3799546 12175->12185 12176 3799543 __commit 12176->11417 12177->12175 12180 3797314 __decode_pointer 6 API calls 12177->12180 12179 379953a 12181 379933f _malloc 3 API calls 12179->12181 12184 379948e 12180->12184 12181->12176 12182 379730b 6 API calls FindHandlerForForeignException 12182->12184 12183 3797314 6 API calls __decode_pointer 12183->12184 12184->12175 12184->12182 12184->12183 12186 379954c 12185->12186 12187 3799527 12185->12187 12190 379a23a LeaveCriticalSection 12186->12190 12187->12176 12189 379a23a LeaveCriticalSection 12187->12189 12189->12179 12190->12187 12192 379ceb8 __commit 12191->12192 12193 379ced0 12192->12193 12198 379ceef _memset 12192->12198 12194 3796742 __commit 66 API calls 12193->12194 12195 379ced5 12194->12195 12196 37966da __commit 6 API calls 12195->12196 12199 379cee5 __commit 12196->12199 12197 379cf61 RtlAllocateHeap 12197->12198 12198->12197 12198->12199 12200 3798416 _malloc 6 API calls 12198->12200 12201 379a314 __lock 66 API calls 12198->12201 12202 379ab26 ___sbh_alloc_block 5 API calls 12198->12202 12204 379cfa8 12198->12204 12199->11425 12200->12198 12201->12198 12202->12198 12207 379a23a LeaveCriticalSection 12204->12207 12206 379cfaf 12206->12198 12207->12206 12208->11441 12215 379a23a LeaveCriticalSection 12209->12215 12211 3797497 12211->11451 12216 379a23a LeaveCriticalSection 12212->12216 12214 37974e5 12214->11456 12215->12211 12216->12214 12218 379a658 12217->12218 12219 379a3b6 12217->12219 12218->11465 12219->12218 12220 379a5a2 VirtualFree 12219->12220 12221 379a606 12220->12221 12221->12218 12222 379a615 VirtualFree HeapFree 12221->12222 12227 379ca30 12222->12227 12231 379a23a LeaveCriticalSection 12224->12231 12226 37963cd 12226->11459 12228 379ca48 12227->12228 12229 379ca6f __VEC_memcpy 12228->12229 12230 379ca77 12228->12230 12229->12230 12230->12218 12231->12226 12233 3797586 __commit 12232->12233 12234 379759e 12233->12234 12236 3797688 __commit 12233->12236 12237 3796370 type_info::_Type_info_dtor 67 API calls 12233->12237 12235 37975ac 12234->12235 12238 3796370 type_info::_Type_info_dtor 67 API calls 12234->12238 12239 37975ba 12235->12239 12240 3796370 type_info::_Type_info_dtor 67 API calls 12235->12240 12236->11471 12237->12234 12238->12235 12241 37975c8 12239->12241 12242 3796370 type_info::_Type_info_dtor 67 API calls 12239->12242 12240->12239 12243 37975d6 12241->12243 12245 3796370 type_info::_Type_info_dtor 67 API calls 12241->12245 12242->12241 12244 37975e4 12243->12244 12246 3796370 type_info::_Type_info_dtor 67 API calls 12243->12246 12247 37975f2 12244->12247 12248 3796370 type_info::_Type_info_dtor 67 API calls 12244->12248 12245->12243 12246->12244 12249 3797603 12247->12249 12250 3796370 type_info::_Type_info_dtor 67 API calls 12247->12250 12248->12247 12251 379a314 __lock 67 API calls 12249->12251 12250->12249 12252 379760b 12251->12252 12253 3797630 12252->12253 12254 3797617 InterlockedDecrement 12252->12254 12268 3797694 12253->12268 12254->12253 12256 3797622 12254->12256 12256->12253 12258 3796370 type_info::_Type_info_dtor 67 API calls 12256->12258 12258->12253 12259 379a314 __lock 67 API calls 12260 3797644 12259->12260 12261 3797675 12260->12261 12263 379714c ___removelocaleref 8 API calls 12260->12263 12271 37976a0 12261->12271 12266 3797659 12263->12266 12265 3796370 type_info::_Type_info_dtor 67 API calls 12265->12236 12266->12261 12267 3796f74 ___freetlocinfo 67 API calls 12266->12267 12267->12261 12274 379a23a LeaveCriticalSection 12268->12274 12270 379763d 12270->12259 12275 379a23a LeaveCriticalSection 12271->12275 12273 3797682 12273->12265 12274->12270 12275->12273 13018 3791317 13019 3791324 13018->13019 13020 3791328 VirtualFree 13019->13020 13021 37911e3 13019->13021 13020->13021 13022 379579a __fltout2 5 API calls 13021->13022 13023 37911fb 13022->13023 14232 404d31 14233 404d56 14232->14233 14234 404d3f 14232->14234 14237 404d64 IsWindowVisible 14233->14237 14243 404d7b 14233->14243 14235 404dbf 14234->14235 14236 404d45 14234->14236 14239 404dc5 CallWindowProcA 14235->14239 14238 403e83 SendMessageA 14236->14238 14237->14235 14240 404d71 14237->14240 14241 404d4f 14238->14241 14239->14241 14242 4046b0 5 API calls 14240->14242 14242->14243 14243->14239 14251 405a43 lstrcpynA 14243->14251 14245 404daa 14252 4059a1 wsprintfA 14245->14252 14247 404db1 14248 40140b 2 API calls 14247->14248 14249 404db8 14248->14249 14253 405a43 lstrcpynA 14249->14253 14251->14245 14252->14247 14253->14235 12375 401734 12376 4029e8 18 API calls 12375->12376 12377 40173b 12376->12377 12378 401761 12377->12378 12379 401759 12377->12379 12415 405a43 lstrcpynA 12378->12415 12414 405a43 lstrcpynA 12379->12414 12382 40175f 12386 405ca1 5 API calls 12382->12386 12383 40176c 12384 405536 3 API calls 12383->12384 12385 401772 lstrcatA 12384->12385 12385->12382 12402 40177e 12386->12402 12387 405d3a 2 API calls 12387->12402 12388 4056fb 2 API calls 12388->12402 12390 401795 CompareFileTime 12390->12402 12391 401859 12393 404de1 25 API calls 12391->12393 12392 401830 12394 404de1 25 API calls 12392->12394 12411 401845 12392->12411 12396 401863 12393->12396 12394->12411 12395 405a43 lstrcpynA 12395->12402 12397 402f01 47 API calls 12396->12397 12398 401876 12397->12398 12399 40188a SetFileTime 12398->12399 12400 40189c FindCloseChangeNotification 12398->12400 12399->12400 12403 4018ad 12400->12403 12400->12411 12401 405a65 18 API calls 12401->12402 12402->12387 12402->12388 12402->12390 12402->12391 12402->12392 12402->12395 12402->12401 12408 405304 MessageBoxIndirectA 12402->12408 12413 40571a GetFileAttributesA CreateFileA 12402->12413 12404 4018b2 12403->12404 12405 4018c5 12403->12405 12406 405a65 18 API calls 12404->12406 12407 405a65 18 API calls 12405->12407 12409 4018ba lstrcatA 12406->12409 12410 4018cd 12407->12410 12408->12402 12409->12410 12410->12411 12412 405304 MessageBoxIndirectA 12410->12412 12412->12411 12413->12402 12414->12382 12415->12383 14254 401934 14255 4029cb 18 API calls 14254->14255 14256 40193b 14255->14256 14257 4029cb 18 API calls 14256->14257 14258 401945 14257->14258 14259 4029e8 18 API calls 14258->14259 14260 40194e 14259->14260 14261 401961 lstrlenA 14260->14261 14264 40199c 14260->14264 14262 40196b 14261->14262 14262->14264 14267 405a43 lstrcpynA 14262->14267 14265 401985 14265->14264 14266 401992 lstrlenA 14265->14266 14266->14264 14267->14265 11069 401ec5 11070 4029e8 18 API calls 11069->11070 11071 401ecc GetFileVersionInfoSizeA 11070->11071 11072 401eef GlobalAlloc 11071->11072 11076 40287d 11071->11076 11073 401f03 GetFileVersionInfoA 11072->11073 11072->11076 11074 401f14 VerQueryValueA 11073->11074 11075 401f45 11073->11075 11074->11075 11077 401f2d 11074->11077 11075->11076 11081 4059a1 wsprintfA 11077->11081 11079 401f39 11082 4059a1 wsprintfA 11079->11082 11081->11079 11082->11075 13083 4018d8 13084 40190f 13083->13084 13085 4029e8 18 API calls 13084->13085 13086 401914 13085->13086 13087 405368 69 API calls 13086->13087 13088 40191d 13087->13088 12426 4022f5 12427 4022fb 12426->12427 12428 4029e8 18 API calls 12427->12428 12429 40230d 12428->12429 12430 4029e8 18 API calls 12429->12430 12431 402317 RegCreateKeyExA 12430->12431 12432 402341 12431->12432 12433 40287d 12431->12433 12434 4029e8 18 API calls 12432->12434 12436 402359 12432->12436 12437 402352 lstrlenA 12434->12437 12435 402365 12439 402380 RegSetValueExA 12435->12439 12440 402f01 47 API calls 12435->12440 12436->12435 12438 4029cb 18 API calls 12436->12438 12437->12436 12438->12435 12441 402396 RegCloseKey 12439->12441 12440->12439 12441->12433 14401 4027f5 14402 4029cb 18 API calls 14401->14402 14403 4027fb 14402->14403 14404 40282c 14403->14404 14405 40264e 14403->14405 14407 402809 14403->14407 14404->14405 14406 405a65 18 API calls 14404->14406 14406->14405 14407->14405 14409 4059a1 wsprintfA 14407->14409 14409->14405 11212 401389 11214 401390 11212->11214 11213 4013fe 11214->11213 11215 4013cb MulDiv SendMessageA 11214->11215 11215->11214 14410 37936b0 14420 37957e0 14410->14420 14413 3793793 14414 379579a __fltout2 5 API calls 14413->14414 14415 37937a7 14414->14415 14416 3793705 _memset 14418 3793763 StrStrA 14416->14418 14419 3793774 14416->14419 14417 379378d RegCloseKey 14417->14413 14418->14416 14418->14419 14419->14413 14419->14417 14421 37936ba RegOpenKeyExA 14420->14421 14421->14413 14421->14416 13662 40248e 13663 4029e8 18 API calls 13662->13663 13664 402495 13663->13664 13667 40571a GetFileAttributesA CreateFileA 13664->13667 13666 4024a1 13667->13666 13671 401e95 13672 4029e8 18 API calls 13671->13672 13673 401e9c 13672->13673 13674 405d3a 2 API calls 13673->13674 13675 401ea2 13674->13675 13677 401eb4 13675->13677 13678 4059a1 wsprintfA 13675->13678 13678->13677 13679 401696 13680 4029e8 18 API calls 13679->13680 13681 40169c GetFullPathNameA 13680->13681 13684 4016b3 13681->13684 13688 4016d4 13681->13688 13682 4016e8 GetShortPathNameA 13683 40287d 13682->13683 13685 405d3a 2 API calls 13684->13685 13684->13688 13686 4016c4 13685->13686 13686->13688 13689 405a43 lstrcpynA 13686->13689 13688->13682 13688->13683 13689->13688 12443 402299 12444 4022c9 12443->12444 12445 40229e 12443->12445 12446 4029e8 18 API calls 12444->12446 12447 402af2 19 API calls 12445->12447 12448 4022d0 12446->12448 12449 4022a5 12447->12449 12454 402a28 RegOpenKeyExA 12448->12454 12450 4029e8 18 API calls 12449->12450 12453 4022e6 12449->12453 12451 4022b6 RegDeleteValueA RegCloseKey 12450->12451 12451->12453 12455 402abc 12454->12455 12463 402a53 12454->12463 12455->12453 12456 402a79 RegEnumKeyA 12457 402a8b RegCloseKey 12456->12457 12456->12463 12459 405d61 3 API calls 12457->12459 12458 402ab0 RegCloseKey 12462 402a9f 12458->12462 12461 402a9b 12459->12461 12460 402a28 3 API calls 12460->12463 12461->12462 12464 402acb RegDeleteKeyA 12461->12464 12462->12455 12463->12456 12463->12457 12463->12458 12463->12460 12464->12462 10684 4023a1 10695 402af2 10684->10695 10686 4023ab 10687 4029e8 18 API calls 10686->10687 10688 4023b4 10687->10688 10689 4023be RegQueryValueExA 10688->10689 10693 40264e 10688->10693 10690 4023e4 RegCloseKey 10689->10690 10691 4023de 10689->10691 10690->10693 10691->10690 10699 4059a1 wsprintfA 10691->10699 10696 4029e8 18 API calls 10695->10696 10697 402b0b 10696->10697 10698 402b19 RegOpenKeyExA 10697->10698 10698->10686 10699->10690 11106 4035a6 11107 4035c1 11106->11107 11108 4035b7 CloseHandle 11106->11108 11109 4035d5 11107->11109 11110 4035cb CloseHandle 11107->11110 11108->11107 11113 405368 11109->11113 11110->11109 11114 405617 18 API calls 11113->11114 11115 40537c 11114->11115 11116 405385 DeleteFileA 11115->11116 11117 40539c 11115->11117 11145 4035e1 11116->11145 11122 4054d1 11117->11122 11151 405a43 lstrcpynA 11117->11151 11119 4053c6 11120 4053d7 11119->11120 11121 4053ca lstrcatA 11119->11121 11125 40557d 2 API calls 11120->11125 11124 4053dd 11121->11124 11123 405d3a 2 API calls 11122->11123 11122->11145 11127 4054f6 11123->11127 11126 4053eb lstrcatA 11124->11126 11128 4053f6 lstrlenA FindFirstFileA 11124->11128 11125->11124 11126->11128 11129 405536 3 API calls 11127->11129 11127->11145 11128->11122 11149 40541a 11128->11149 11130 405500 11129->11130 11132 4056fb 2 API calls 11130->11132 11131 405561 CharNextA 11131->11149 11133 405506 RemoveDirectoryA 11132->11133 11134 405511 11133->11134 11135 405528 11133->11135 11140 404de1 25 API calls 11134->11140 11134->11145 11138 404de1 25 API calls 11135->11138 11136 4054b0 FindNextFileA 11139 4054c8 FindClose 11136->11139 11136->11149 11138->11145 11139->11122 11141 40551f 11140->11141 11142 405791 39 API calls 11141->11142 11142->11145 11144 405368 60 API calls 11144->11149 11147 404de1 25 API calls 11147->11136 11148 404de1 25 API calls 11148->11149 11149->11131 11149->11136 11149->11144 11149->11147 11149->11148 11150 405791 39 API calls 11149->11150 11152 405a43 lstrcpynA 11149->11152 11153 4056fb GetFileAttributesA 11149->11153 11150->11149 11151->11119 11152->11149 11154 40547d DeleteFileA 11153->11154 11155 40570a SetFileAttributesA 11153->11155 11154->11149 11155->11154 12282 401bad 12304 4029cb 12282->12304 12284 401bb4 12285 4029cb 18 API calls 12284->12285 12286 401bbe 12285->12286 12287 401bce 12286->12287 12288 4029e8 18 API calls 12286->12288 12289 401bde 12287->12289 12290 4029e8 18 API calls 12287->12290 12288->12287 12291 401be9 12289->12291 12292 401c2d 12289->12292 12290->12289 12294 4029cb 18 API calls 12291->12294 12293 4029e8 18 API calls 12292->12293 12295 401c32 12293->12295 12296 401bee 12294->12296 12297 4029e8 18 API calls 12295->12297 12298 4029cb 18 API calls 12296->12298 12299 401c3b FindWindowExA 12297->12299 12300 401bf7 12298->12300 12303 401c59 12299->12303 12301 401c1d SendMessageA 12300->12301 12302 401bff SendMessageTimeoutA 12300->12302 12301->12303 12302->12303 12305 405a65 18 API calls 12304->12305 12306 4029df 12305->12306 12306->12284 12356 4015b3 12357 4029e8 18 API calls 12356->12357 12358 4015ba 12357->12358 12359 4055ca 4 API calls 12358->12359 12371 4015c2 12359->12371 12360 40160a 12361 40162d 12360->12361 12362 40160f 12360->12362 12368 401423 25 API calls 12361->12368 12364 401423 25 API calls 12362->12364 12363 405561 CharNextA 12365 4015d0 CreateDirectoryA 12363->12365 12366 401616 12364->12366 12367 4015e5 GetLastError 12365->12367 12365->12371 12374 405a43 lstrcpynA 12366->12374 12370 4015f2 GetFileAttributesA 12367->12370 12367->12371 12373 40215b 12368->12373 12370->12371 12371->12360 12371->12363 12372 401621 SetCurrentDirectoryA 12372->12373 12374->12372 12465 3791080 CreateFileA 12466 37910e9 ReadFile 12465->12466 12480 37911e1 12465->12480 12467 37911da CloseHandle 12466->12467 12468 3791106 12466->12468 12467->12480 12468->12467 12470 379111f SetFilePointer 12468->12470 12469 379579a __fltout2 5 API calls 12471 37911fb 12469->12471 12470->12467 12472 3791137 ReadFile 12470->12472 12472->12467 12473 3791154 12472->12473 12473->12467 12474 3791189 GetFileSize VirtualAlloc 12473->12474 12474->12467 12475 37911ae SetFilePointer ReadFile 12474->12475 12476 37911cd VirtualFree 12475->12476 12477 3791202 CloseHandle 12475->12477 12476->12467 12481 379121e 12477->12481 12478 37912ef 12479 3791328 VirtualFree 12478->12479 12478->12480 12479->12480 12480->12469 12481->12478 12483 3791340 12481->12483 12484 379149e 12483->12484 12487 379136c 12483->12487 12485 379579a __fltout2 5 API calls 12484->12485 12486 37914b1 12485->12486 12486->12478 12487->12484 12495 3791d60 12487->12495 12489 37913dd 12489->12484 12490 37913f3 12489->12490 12507 37915a0 12490->12507 12493 379579a __fltout2 5 API calls 12494 3791466 12493->12494 12494->12478 12496 3791d92 12495->12496 12500 3791dae 12495->12500 12497 379579a __fltout2 5 API calls 12496->12497 12498 3791da7 12497->12498 12498->12489 12499 3791e44 12501 379579a __fltout2 5 API calls 12499->12501 12500->12496 12500->12499 12503 3791dd4 12500->12503 12502 3791e59 12501->12502 12502->12489 12503->12499 12504 3791e11 12503->12504 12505 379579a __fltout2 5 API calls 12504->12505 12506 3791e3d 12505->12506 12506->12489 12508 37915c0 _memset 12507->12508 12509 379579a __fltout2 5 API calls 12508->12509 12510 3791423 12509->12510 12510->12493

                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                        Function 00403225 Relevance: 75.5, APIs: 24, Strings: 19, Instructions: 270filestringcomCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 0 403225-4032ba #17 SetErrorMode OleInitialize call 405d61 SHGetFileInfoA call 405a43 GetCommandLineA call 405a43 GetModuleHandleA 7 4032c6-4032db call 405561 CharNextA 0->7 8 4032bc-4032c1 0->8 11 403340-403344 7->11 8->7 12 403346 11->12 13 4032dd-4032e0 11->13 16 403359-403371 GetTempPathA call 4031f1 12->16 14 4032e2-4032e6 13->14 15 4032e8-4032f0 13->15 14->14 14->15 17 4032f2-4032f3 15->17 18 4032f8-4032fb 15->18 26 403393-4033aa DeleteFileA call 402c5b 16->26 27 403373-403391 GetWindowsDirectoryA lstrcatA call 4031f1 16->27 17->18 20 403330-40333d call 405561 18->20 21 4032fd-403301 18->21 20->11 34 40333f 20->34 24 403311-403317 21->24 25 403303-40330c 21->25 31 403327-40332e 24->31 32 403319-403322 24->32 25->24 29 40330e 25->29 39 403411-403420 ExitProcess OleUninitialize 26->39 40 4033ac-4033b2 26->40 27->26 27->39 29->24 31->20 37 403348-403354 call 405a43 31->37 32->31 36 403324 32->36 34->11 36->31 37->16 44 403426-403436 call 405304 ExitProcess 39->44 45 40350b-403511 39->45 42 403401-403408 call 4035e3 40->42 43 4033b4-4033bd call 405561 40->43 52 40340d 42->52 58 4033c8-4033ca 43->58 49 403513-403530 call 405d61 * 3 45->49 50 40358e-403596 45->50 73 403532-403534 49->73 74 40357a-403585 ExitWindowsEx 49->74 54 403598 50->54 55 40359c-4035a0 ExitProcess 50->55 52->39 54->55 60 4033cc-4033d6 58->60 61 4033bf-4033c5 58->61 64 4033d8-4033e5 call 405617 60->64 65 40343c-403456 lstrcatA lstrcmpiA 60->65 61->60 63 4033c7 61->63 63->58 64->39 76 4033e7-4033fd call 405a43 * 2 64->76 65->39 67 403458-40346d CreateDirectoryA SetCurrentDirectoryA 65->67 70 40347a-403494 call 405a43 67->70 71 40346f-403475 call 405a43 67->71 85 403499-4034b5 call 405a65 DeleteFileA 70->85 71->70 73->74 79 403536-403538 73->79 74->50 78 403587-403589 call 40140b 74->78 76->42 78->50 79->74 83 40353a-40354c GetCurrentProcess 79->83 83->74 93 40354e-403570 83->93 91 4034f6-4034fd 85->91 92 4034b7-4034c7 CopyFileA 85->92 91->85 95 4034ff-403506 call 405791 91->95 92->91 94 4034c9-4034e9 call 405791 call 405a65 call 4052a3 92->94 93->74 94->91 105 4034eb-4034f2 CloseHandle 94->105 95->39 105->91
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • #17.COMCTL32 ref: 00403244
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(00008001), ref: 0040324F
                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00403256
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        • SHGetFileInfoA.SHELL32(0041F4B8,00000000,?,00000160,00000000,00000008), ref: 0040327E
                                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                                        • GetCommandLineA.KERNEL32(00423700,NSIS Error), ref: 00403293
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000000), ref: 004032A6
                                                                                                                                                                                                        • CharNextA.USER32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000020), ref: 004032D1
                                                                                                                                                                                                        • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403364
                                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403379
                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403385
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(1033), ref: 00403398
                                                                                                                                                                                                        • ExitProcess.KERNEL32(00000000), ref: 00403411
                                                                                                                                                                                                        • OleUninitialize.OLE32(00000000), ref: 00403416
                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403436
                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000000,00000000), ref: 00403442
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Program Files (x86)\360\360Desktop\modules), ref: 0040344E
                                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040345A
                                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403461
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(0041F0B8,0041F0B8,?,08bcc5cf9e3fc589107741a5e999ecfa,?), ref: 004034AB
                                                                                                                                                                                                        • CopyFileA.KERNEL32(C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,0041F0B8,00000001), ref: 004034BF
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,0041F0B8,0041F0B8,?,0041F0B8,00000000), ref: 004034EC
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403541
                                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,00000000), ref: 0040357D
                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004035A0
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExitFileProcess$DirectoryHandle$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                                                                                                                                                                                        • String ID: /D=$ _?=$"$"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$08bcc5cf9e3fc589107741a5e999ecfa$1033$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe$C:\Users\user\AppData\Local\360GameBox$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\360GameUsers$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$/K
                                                                                                                                                                                                        • API String ID: 553446912-3996685184
                                                                                                                                                                                                        • Opcode ID: fb41fee89ba53f5f954ddc00feaadec79406564f2c50884a474d204cec2155aa
                                                                                                                                                                                                        • Instruction ID: 12b4adbb734880863a6c7b42456f84a79c3c9dcdf907d3cda67c8baecb7e3ac4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb41fee89ba53f5f954ddc00feaadec79406564f2c50884a474d204cec2155aa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD91C370A08351BFD721AFA1AD89B1B7EACAB40306F44453BF541B61D2C77C9E418B6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405368 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 284 405368-405383 call 405617 287 405385-405397 DeleteFileA 284->287 288 40539c-4053a6 284->288 291 405530-405533 287->291 289 4053a8-4053aa 288->289 290 4053ba-4053c8 call 405a43 288->290 292 4053b0-4053b4 289->292 293 4054db-4054e1 289->293 297 4053d7-4053d8 call 40557d 290->297 298 4053ca-4053d5 lstrcatA 290->298 292->290 292->293 293->291 296 4054e3-4054e6 293->296 299 4054f0-4054f8 call 405d3a 296->299 300 4054e8-4054ee 296->300 302 4053dd-4053e0 297->302 298->302 299->291 307 4054fa-40550f call 405536 call 4056fb RemoveDirectoryA 299->307 300->291 305 4053e2-4053e9 302->305 306 4053eb-4053f1 lstrcatA 302->306 305->306 308 4053f6-405414 lstrlenA FindFirstFileA 305->308 306->308 323 405511-405515 307->323 324 405528-40552b call 404de1 307->324 310 4054d1-4054d5 308->310 311 40541a-405431 call 405561 308->311 310->293 313 4054d7 310->313 318 405433-405437 311->318 319 40543c-40543f 311->319 313->293 318->319 320 405439 318->320 321 405441-405446 319->321 322 405452-405460 call 405a43 319->322 320->319 325 4054b0-4054c2 FindNextFileA 321->325 326 405448-40544a 321->326 334 405462-40546a 322->334 335 405477-405486 call 4056fb DeleteFileA 322->335 323->300 328 405517-405526 call 404de1 call 405791 323->328 324->291 325->311 332 4054c8-4054cb FindClose 325->332 326->322 330 40544c-405450 326->330 328->291 330->322 330->325 332->310 334->325 337 40546c-405475 call 405368 334->337 344 4054a8-4054ab call 404de1 335->344 345 405488-40548c 335->345 337->325 344->325 346 4054a0-4054a6 345->346 347 40548e-40549e call 404de1 call 405791 345->347 346->325 347->325
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 00405386
                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 004053D0
                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 004053F1
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 004053F7
                                                                                                                                                                                                        • FindFirstFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\*.*,?,?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 00405408
                                                                                                                                                                                                        • FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 004054BA
                                                                                                                                                                                                        • FindClose.KERNEL32(?), ref: 004054CB
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\*.*$\*.*
                                                                                                                                                                                                        • API String ID: 2035342205-924778982
                                                                                                                                                                                                        • Opcode ID: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                                        • Instruction ID: 005fd70f037958758636dfc326b5af0e8b30b209f19d8c1cd7988b565b373fb6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1B51E030904A447ADB216B618C89BFF3A68DF4271AF54807BF945711D2C77C4982DE6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405A65 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 195stringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 353 405a65-405a70 354 405a72-405a81 353->354 355 405a83-405aa0 353->355 354->355 356 405aa6-405aad 355->356 357 405c7e-405c82 355->357 356->357 358 405ab2-405abc 357->358 359 405c88-405c92 357->359 358->359 362 405ac2-405ac9 358->362 360 405c94-405c98 call 405a43 359->360 361 405c9d-405c9e 359->361 360->361 364 405c71 362->364 365 405acf-405b00 362->365 366 405c73-405c79 364->366 367 405c7b-405c7d 364->367 368 405b06-405b11 GetVersion 365->368 369 405c1b-405c1e 365->369 366->357 367->357 370 405b13-405b17 368->370 371 405b2b 368->371 372 405c20-405c23 369->372 373 405c4e-405c51 369->373 370->371 374 405b19-405b1d 370->374 377 405b32-405b39 371->377 375 405c33-405c3f call 405a43 372->375 376 405c25-405c31 call 4059a1 372->376 378 405c53-405c5a call 405a65 373->378 379 405c5f-405c6f lstrlenA 373->379 374->371 380 405b1f-405b23 374->380 390 405c44-405c4a 375->390 376->390 382 405b3b-405b3d 377->382 383 405b3e-405b40 377->383 378->379 379->357 380->371 386 405b25-405b29 380->386 382->383 388 405b42-405b65 call 40592a 383->388 389 405b79-405b7c 383->389 386->377 402 405c02-405c06 388->402 403 405b6b-405b74 call 405a65 388->403 391 405b8c-405b8f 389->391 392 405b7e-405b8a GetSystemDirectoryA 389->392 390->379 394 405c4c 390->394 396 405b91-405b9f GetWindowsDirectoryA 391->396 397 405bf9-405bfb 391->397 395 405bfd-405c00 392->395 399 405c13-405c19 call 405ca1 394->399 395->399 395->402 396->397 397->395 401 405ba1-405bab 397->401 399->379 405 405bc5-405bdb SHGetSpecialFolderLocation 401->405 406 405bad-405bb0 401->406 402->399 408 405c08-405c0e lstrcatA 402->408 403->395 410 405bf6 405->410 411 405bdd-405bf4 SHGetPathFromIDListA CoTaskMemFree 405->411 406->405 409 405bb2-405bb9 406->409 408->399 413 405bc1-405bc3 409->413 410->397 411->395 411->410 413->395 413->405
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetVersion.KERNEL32(00000000,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405B09
                                                                                                                                                                                                        • GetSystemDirectoryA.KERNEL32(00422EA0,00000400), ref: 00405B84
                                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(00422EA0,00000400), ref: 00405B97
                                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405BD3
                                                                                                                                                                                                        • SHGetPathFromIDListA.SHELL32(00000000,00422EA0), ref: 00405BE1
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00405BEC
                                                                                                                                                                                                        • lstrcatA.KERNEL32(00422EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405C0E
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00422EA0,00000000,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405C60
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • 08bcc5cf9e3fc589107741a5e999ecfa, xrefs: 00405C38
                                                                                                                                                                                                        • \Microsoft\Internet Explorer\Quick Launch, xrefs: 00405C08
                                                                                                                                                                                                        • Software\Microsoft\Windows\CurrentVersion, xrefs: 00405B53
                                                                                                                                                                                                        • W7L, xrefs: 00405A72
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa$Software\Microsoft\Windows\CurrentVersion$W7L$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                        • API String ID: 900638850-3680261703
                                                                                                                                                                                                        • Opcode ID: 469b56c69d40f599ef2b67fe3bb7f66555fc68042eb2b2e553d3e38b50134655
                                                                                                                                                                                                        • Instruction ID: 9b1bf7279014b7c8101eb7e454522d29597b913ca5fabe9a72ab98517bc843d5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 469b56c69d40f599ef2b67fe3bb7f66555fc68042eb2b2e553d3e38b50134655
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 50512671A04A05AAEB205F68DC84B7F3B74EB11714F14023BE911B62E1D33C6982DF5E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040600A Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                                        • Instruction ID: 4dd2872783d64c99001b1edb157d711bf7c17726e9b979133eda9d6147b50661
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DF15671D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405D3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindFirstFileA.KERNEL32(?,00422550,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 00405D45
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405D51
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                                        • API String ID: 2295610775-3404278061
                                                                                                                                                                                                        • Opcode ID: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                                        • Instruction ID: fa9aa61da9af08e62d153dff6cda9e4686c5a383a1128ef99b384ed87a871bf9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6DD0C9319095206BC20027286D0C84B6A59DF09330710CA73B12AF22F0D27499628AA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004035E3 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 213stringregistrylibraryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 106 4035e3-4035fb call 405d61 109 4035fd-40360d call 4059a1 106->109 110 40360f-403636 call 40592a 106->110 119 403659-403678 call 403897 call 405617 109->119 115 403638-403649 call 40592a 110->115 116 40364e-403654 lstrcatA 110->116 115->116 116->119 124 40367e-403683 119->124 125 4036ff-403707 call 405617 119->125 124->125 126 403685-4036a9 call 40592a 124->126 131 403715-40373a LoadImageA 125->131 132 403709-403710 call 405a65 125->132 126->125 133 4036ab-4036ad 126->133 135 403740-403776 RegisterClassA 131->135 136 4037c9-4037d1 call 40140b 131->136 132->131 137 4036be-4036ca lstrlenA 133->137 138 4036af-4036bc call 405561 133->138 139 40377c-4037c4 SystemParametersInfoA CreateWindowExA 135->139 140 40388d 135->140 147 4037d3-4037d6 136->147 148 4037db-4037e6 call 403897 136->148 145 4036f2-4036fa call 405536 call 405a43 137->145 146 4036cc-4036da lstrcmpiA 137->146 138->137 139->136 143 40388f-403896 140->143 145->125 146->145 151 4036dc-4036e6 GetFileAttributesA 146->151 147->143 159 403864-40386c call 404eb3 148->159 160 4037e8-403805 ShowWindow LoadLibraryA 148->160 154 4036e8-4036ea 151->154 155 4036ec-4036ed call 40557d 151->155 154->145 154->155 155->145 168 403886-403888 call 40140b 159->168 169 40386e-403874 159->169 161 403807-40380c LoadLibraryA 160->161 162 40380e-403820 GetClassInfoA 160->162 161->162 164 403822-403832 GetClassInfoA RegisterClassA 162->164 165 403838-403862 DialogBoxParamA call 40140b 162->165 164->165 165->143 168->140 169->147 170 40387a-403881 call 40140b 169->170 170->147
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        • lstrcatA.KERNEL32(1033,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403654
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00422EA0,?,?,?,00422EA0,00000000,C:\Users\user\AppData\Local\360GameBox,1033,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S), ref: 004036BF
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 004036D2
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00422EA0), ref: 004036DD
                                                                                                                                                                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\360GameBox), ref: 00403726
                                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                                        • RegisterClassA.USER32 ref: 0040376D
                                                                                                                                                                                                        • SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403785
                                                                                                                                                                                                        • CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037BE
                                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 004037F0
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd20), ref: 00403801
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd32), ref: 0040380C
                                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,004236A0), ref: 0040381C
                                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit,004236A0), ref: 00403829
                                                                                                                                                                                                        • RegisterClassA.USER32(004236A0), ref: 00403832
                                                                                                                                                                                                        • DialogBoxParamA.USER32(?,00000000,00403964,00000000), ref: 00403851
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\360GameBox$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$/K
                                                                                                                                                                                                        • API String ID: 914957316-2771103267
                                                                                                                                                                                                        • Opcode ID: de68ff42640f5c92571cf0b0f27c195ab9ad0e0da92133742f2957dbb00c9211
                                                                                                                                                                                                        • Instruction ID: 94625ed8aaa298a99e1261382a478c85dd538f94d9e759fa5c435ea2279a3c1b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: de68ff42640f5c92571cf0b0f27c195ab9ad0e0da92133742f2957dbb00c9211
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D61B3B1604200BED620AF65AD45E2B3AADEB4474AF44447FF940B22E1D77D9E018A2E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402C5B Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 175 402c5b-402ca9 GetTickCount GetModuleFileNameA call 40571a 178 402cb5-402ce3 call 405a43 call 40557d call 405a43 GetFileSize 175->178 179 402cab-402cb0 175->179 187 402dd3-402de1 call 402bc5 178->187 188 402ce9-402d00 178->188 180 402efa-402efe 179->180 194 402eb2-402eb7 187->194 195 402de7-402dea 187->195 190 402d02 188->190 191 402d04-402d0a call 4031a8 188->191 190->191 196 402d0f-402d11 191->196 194->180 197 402e16-402e62 GlobalAlloc call 405e3b call 405749 CreateFileA 195->197 198 402dec-402e04 call 4031da call 4031a8 195->198 199 402d17-402d1d 196->199 200 402e6e-402e76 call 402bc5 196->200 224 402e64-402e69 197->224 225 402e78-402ea8 call 4031da call 402f01 197->225 198->194 227 402e0a-402e10 198->227 204 402d9d-402da1 199->204 205 402d1f-402d37 call 4056db 199->205 200->194 210 402da3-402da9 call 402bc5 204->210 211 402daa-402db0 204->211 205->211 220 402d39-402d40 205->220 210->211 212 402db2-402dc0 call 405dcd 211->212 213 402dc3-402dcd 211->213 212->213 213->187 213->188 220->211 226 402d42-402d49 220->226 224->180 235 402ead-402eb0 225->235 226->211 228 402d4b-402d52 226->228 227->194 227->197 228->211 230 402d54-402d5b 228->230 230->211 232 402d5d-402d7d 230->232 232->194 234 402d83-402d87 232->234 236 402d89-402d8d 234->236 237 402d8f-402d97 234->237 235->194 238 402eb9-402eca 235->238 236->187 236->237 237->211 239 402d99-402d9b 237->239 240 402ed2-402ed7 238->240 241 402ecc 238->241 239->211 242 402ed8-402ede 240->242 241->240 242->242 243 402ee0-402ef8 call 4056db 242->243 243->180
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402C6F
                                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,00000400), ref: 00402C8B
                                                                                                                                                                                                          • Part of subcall function 0040571A: GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                                          • Part of subcall function 0040571A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,GBInst.exe,00000000,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 00402CD4
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00409190), ref: 00402E1B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E64
                                                                                                                                                                                                        • soft, xrefs: 00402D4B
                                                                                                                                                                                                        • The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t, xrefs: 00402EB2
                                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe, xrefs: 00402C75, 00402C84, 00402C98, 00402CB5
                                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 00402CB6, 00402CBB, 00402CC1
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5B, 00402E33
                                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S, xrefs: 00402C68
                                                                                                                                                                                                        • Error launching installer, xrefs: 00402CAB
                                                                                                                                                                                                        • Inst, xrefs: 00402D42
                                                                                                                                                                                                        • Null, xrefs: 00402D54
                                                                                                                                                                                                        • GBInst.exe, xrefs: 00402CC8
                                                                                                                                                                                                        • /K, xrefs: 00402EBD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe$C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$GBInst.exe$Inst$Null$The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t$soft$/K
                                                                                                                                                                                                        • API String ID: 2803837635-2739410912
                                                                                                                                                                                                        • Opcode ID: 929a9361b184f8481831f9e318c9a22800816f4363022c87f3a4d53be2a937c6
                                                                                                                                                                                                        • Instruction ID: 98420d4c95cb0715ed39ffe41bcd432428fd7d62b31351ae7306db0730cac7b6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 929a9361b184f8481831f9e318c9a22800816f4363022c87f3a4d53be2a937c6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C61C231E40214ABDB20DF64EE49B9A7BB4AB48315F50413BF904B72D1D7BC9E418BAD
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405791 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 144filememoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 246 405791-4057a2 call 405d61 249 4057a4-4057af MoveFileExA 246->249 250 4057b5-4057d1 246->250 249->250 251 4058ee 249->251 252 4057d3-4057eb call 40571a CloseHandle GetShortPathNameA 250->252 253 4057f9-405808 GetShortPathNameA 250->253 254 4058f4-4058f8 251->254 252->254 259 4057f1-4057f3 252->259 253->254 255 40580e-405810 253->255 255->254 258 405816-405854 wsprintfA call 405a65 call 40571a 255->258 258->251 264 40585a-405876 GetFileSize GlobalAlloc 258->264 259->253 259->254 265 4058e7-4058e8 CloseHandle 264->265 266 405878-40588a ReadFile 264->266 265->251 266->265 267 40588c-405890 266->267 267->265 268 405892-40589f call 40568f 267->268 271 4058a1-4058af call 405a43 268->271 272 4058fb-40590b call 40568f 268->272 277 4058b2 271->277 272->277 278 40590d-405915 272->278 279 4058b4-4058e1 call 4056db SetFilePointer WriteFile GlobalFree 277->279 280 405922-405928 278->280 281 405917-405920 278->281 279->265 280->279 281->280 281->281
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        • MoveFileExA.KERNEL32(00000000,?,00000005,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057AB
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057DE
                                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(?,00422690,00000400), ref: 004057E7
                                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(00000000,00422108,00000400), ref: 00405804
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405822
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00422108,C0000000,00000004,00422108,?,?,?,00000000,000000F1,?), ref: 0040585D
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040586C
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 00405882
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D08,00000000,-0000000A,004093B0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004058C8
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004058DA
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004058E1
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 004058E8
                                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModuleMovePointerProcReadSizeWritewsprintf
                                                                                                                                                                                                        • String ID: %s=%s$[Rename]$/K
                                                                                                                                                                                                        • API String ID: 3178728463-2993702373
                                                                                                                                                                                                        • Opcode ID: 707e7d83803ccec2868aa6b1360760e81c4db2d53c34dc02baddd888dc1c6b67
                                                                                                                                                                                                        • Instruction ID: b4a0761097f53e27704103e00ee6cd595734002638f7a2c326e30edaa923f398
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 707e7d83803ccec2868aa6b1360760e81c4db2d53c34dc02baddd888dc1c6b67
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54410432A05B11BBE7206B619D49F6B3A6CEF44715F044436FD05F62D2E678A8018EBD
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03793170 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 102COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 037931AA
                                                                                                                                                                                                        • _memset.LIBCMT ref: 037931C7
                                                                                                                                                                                                        • SHGetValueW.SHLWAPI ref: 037931F1
                                                                                                                                                                                                        • PathFileExistsW.SHLWAPI(?), ref: 03793200
                                                                                                                                                                                                        • PathRemoveFileSpecW.SHLWAPI(?), ref: 0379320F
                                                                                                                                                                                                        • _wcsrchr.LIBCMT ref: 0379321C
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 03793238
                                                                                                                                                                                                        • PathRemoveFileSpecW.SHLWAPI(?), ref: 03793243
                                                                                                                                                                                                        • _wcsrchr.LIBCMT ref: 03793250
                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,?,00001000,?,?,00000104,?), ref: 0379329F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exe, xrefs: 037931DF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Path$RemoveSpec_memset_wcsrchr$EnvironmentExistsExpandModuleNameStringsValue
                                                                                                                                                                                                        • String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exe
                                                                                                                                                                                                        • API String ID: 3366726608-2006824863
                                                                                                                                                                                                        • Opcode ID: bb6313a22840583c9c99f91d704ba1f735c29525054fb24ed1e9d5d5ab7d5919
                                                                                                                                                                                                        • Instruction ID: 3ee4e612ee4e8efd776c8108b187d995b5a419c5c51dc3899af74ed09c6130f6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb6313a22840583c9c99f91d704ba1f735c29525054fb24ed1e9d5d5ab7d5919
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6316279104301AFFB14EB64EC49F9B73E9AFD4700F448A1EF5598A181E774D208CBA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03791080 Relevance: 18.2, APIs: 12, Instructions: 216filememoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 442 3791080-37910e3 CreateFileA 443 37910e9-3791100 ReadFile 442->443 444 37911e1 442->444 446 37911da-37911db CloseHandle 443->446 447 3791106-379110a 443->447 445 37911e3-3791201 call 379579a 444->445 446->444 447->446 449 3791110-3791119 447->449 449->446 450 379111f-3791131 SetFilePointer 449->450 450->446 452 3791137-379114e ReadFile 450->452 452->446 453 3791154-379115b 452->453 453->446 454 379115d-3791167 453->454 454->446 455 3791169-3791171 454->455 455->446 456 3791173-3791187 455->456 456->446 457 3791189-37911ac GetFileSize VirtualAlloc 456->457 457->446 458 37911ae-37911cb SetFilePointer ReadFile 457->458 459 37911cd-37911d4 VirtualFree 458->459 460 3791202-3791233 CloseHandle call 3791010 458->460 459->446 463 3791236-3791241 460->463 464 37912f8-37912ff 463->464 465 3791247-379124d 463->465 466 3791324-3791326 464->466 467 3791309-379130c 465->467 468 3791253-3791257 465->468 470 3791328-3791330 VirtualFree 466->470 471 3791336-3791339 466->471 467->463 467->466 468->467 469 379125d-3791275 468->469 472 3791278-3791283 469->472 470->471 471->445 472->464 473 3791285-379128d 472->473 474 379128f-3791294 473->474 475 3791301-3791304 473->475 476 37912a1-37912f5 call 3791010 * 2 call 3791340 474->476 477 3791296-379129e 474->477 475->472 476->464 477->476
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,666B1DA4), ref: 037910D8
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,00000040,?,00000000), ref: 037910FC
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 03791128
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,000000F8,?,00000000), ref: 0379114A
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 0379118C
                                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 0379119F
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 037911B5
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 037911C7
                                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 037911D4
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 037911DB
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 03791203
                                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03791330
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$ReadVirtual$CloseFreeHandlePointer$AllocCreateSize
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3202141896-0
                                                                                                                                                                                                        • Opcode ID: 53b0bc5f97593f08ed220689e53020a2836cf66c0fce48e0a62e5e016b6b62d4
                                                                                                                                                                                                        • Instruction ID: 58c94fb610557879cd7f26d4de92175b5ce07874c6a88ebd78f53aaa7930c728
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 53b0bc5f97593f08ed220689e53020a2836cf66c0fce48e0a62e5e016b6b62d4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1819171A0070AEBEF24DF64EC45BAA77B8FF48711F54821AF919AB280E7749910CB54
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401734 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147stringtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 484 401734-401757 call 4029e8 call 4055a3 489 401761-401773 call 405a43 call 405536 lstrcatA 484->489 490 401759-40175f call 405a43 484->490 495 401778-40177e call 405ca1 489->495 490->495 500 401783-401787 495->500 501 401789-401793 call 405d3a 500->501 502 4017ba-4017bd 500->502 509 4017a5-4017b7 501->509 510 401795-4017a3 CompareFileTime 501->510 503 4017c5-4017e1 call 40571a 502->503 504 4017bf-4017c0 call 4056fb 502->504 512 4017e3-4017e6 503->512 513 401859-401882 call 404de1 call 402f01 503->513 504->503 509->502 510->509 514 4017e8-40182a call 405a43 * 2 call 405a65 call 405a43 call 405304 512->514 515 40183b-401845 call 404de1 512->515 525 401884-401888 513->525 526 40188a-401896 SetFileTime 513->526 514->500 549 401830-401831 514->549 527 40184e-401854 515->527 525->526 529 40189c-4018a7 FindCloseChangeNotification 525->529 526->529 530 402886 527->530 533 40287d-402880 529->533 534 4018ad-4018b0 529->534 535 402888-40288c 530->535 533->530 537 4018b2-4018c3 call 405a65 lstrcatA 534->537 538 4018c5-4018c8 call 405a65 534->538 544 4018cd-4021fb 537->544 538->544 547 402200-402205 544->547 548 4021fb call 405304 544->548 547->535 548->547 549->527 550 401833-401834 549->550 550->515
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\360GameBox\,C:\Users\user\AppData\Roaming\360GameUsers,00000000,00000000,00000031), ref: 00401773
                                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\360GameBox\,C:\Users\user\AppData\Local\360GameBox\,00000000,00000000,C:\Users\user\AppData\Local\360GameBox\,C:\Users\user\AppData\Roaming\360GameUsers,00000000,00000000,00000031), ref: 0040179D
                                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa$C:\Users\user\AppData\Local\360GameBox\$C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp$C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\NSISdl.dll$C:\Users\user\AppData\Roaming\360GameUsers
                                                                                                                                                                                                        • API String ID: 1941528284-1740079552
                                                                                                                                                                                                        • Opcode ID: c6b8b9970bee9d45ebc815c6754534fa9749124c6462540bd95c5d8816cef9e4
                                                                                                                                                                                                        • Instruction ID: 502ebc8251cf4d34670626f1a6973296816b4538e99af67961374f69fd5ad3b4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c6b8b9970bee9d45ebc815c6754534fa9749124c6462540bd95c5d8816cef9e4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B41E371A00514BACF10BBB9DD86DAF3A69EF45368B20433BF111B11E1D67C8B418E6D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040302C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108fileCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 551 40302c-403055 GetTickCount 552 403196-40319e call 402bc5 551->552 553 40305b-403086 call 4031da SetFilePointer 551->553 558 4031a0-4031a5 552->558 559 40308b-40309d 553->559 560 4030a1-4030af call 4031a8 559->560 561 40309f 559->561 564 4030b5-4030c1 560->564 565 403188-40318b 560->565 561->560 566 4030c7-4030cd 564->566 565->558 567 4030f8-403114 call 405e5b 566->567 568 4030cf-4030d5 566->568 574 403191 567->574 575 403116-40311e 567->575 568->567 569 4030d7-4030f7 call 402bc5 568->569 569->567 576 403193-403194 574->576 577 403120-403136 WriteFile 575->577 578 403152-403158 575->578 576->558 580 403138-40313c 577->580 581 40318d-40318f 577->581 578->574 579 40315a-40315c 578->579 579->574 583 40315e-403171 579->583 580->581 582 40313e-40314a 580->582 581->576 582->566 584 403150 582->584 583->559 585 403177-403186 SetFilePointer 583->585 584->583 585->552
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00403041
                                                                                                                                                                                                          • Part of subcall function 004031DA: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,0001B9E4), ref: 004031E8
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403074
                                                                                                                                                                                                        • WriteFile.KERNEL32(0040B0A0,0040E8EA,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 0040312E
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(001431BE,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 00403180
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Pointer$CountTickWrite
                                                                                                                                                                                                        • String ID: /K$@
                                                                                                                                                                                                        • API String ID: 2146148272-450884121
                                                                                                                                                                                                        • Opcode ID: 9bb1637fe3a7e8d78cc3cf5a3cb65ba5c061e076c754ce29f264143e6fd1b051
                                                                                                                                                                                                        • Instruction ID: b900033f33315bf13e96bf0933fc3f5ca139b675e2fdc73b2e3f7a71e75fad19
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9bb1637fe3a7e8d78cc3cf5a3cb65ba5c061e076c754ce29f264143e6fd1b051
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1641AE72505205AFC720DF18EE8496B3FBCF748356B01463FE520BA2E0D7386A459BAD
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040266E Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0001BA00,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026C2
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026DE
                                                                                                                                                                                                        • GlobalFree.KERNELBASE(?), ref: 00402717
                                                                                                                                                                                                        • WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402729
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00402730
                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402748
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040275C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3294113728-0
                                                                                                                                                                                                        • Opcode ID: b1d3b1ff547f166b56dfa2d182746bf114cb3c1d76116d140a83ef0ce10bd25b
                                                                                                                                                                                                        • Instruction ID: c44f166cf789c73980343851032ece5a06a24c9bd4eff2e899fc72ce2868172c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b1d3b1ff547f166b56dfa2d182746bf114cb3c1d76116d140a83ef0ce10bd25b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79318D71C00128BBDF116FA5CE89D9E7E79EF09324F10422AF914762E0C7795D419BA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03793390 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 037933D9
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?,?,360verify.dll), ref: 0379341F
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCIDA), ref: 03793431
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,360verify.dll), ref: 03793447
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Library$AddressFreeLoadProc_memset
                                                                                                                                                                                                        • String ID: 360verify.dll$GetCIDA
                                                                                                                                                                                                        • API String ID: 278593715-1662812359
                                                                                                                                                                                                        • Opcode ID: 99f823a6bf9eed64fe7ecb3d2e9336047be796aedb51a4f066ae48dd7420734c
                                                                                                                                                                                                        • Instruction ID: 1af0dc3466556813a9caba5f49f2ddea09de225edfe76b987447283c90838648
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99f823a6bf9eed64fe7ecb3d2e9336047be796aedb51a4f066ae48dd7420734c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A211B979604300ABF721E734EC45BEFB3E89FD8B10F458A1EE99586181EB74D544C6A2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004022F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 640 4022f5-40233b call 402add call 4029e8 * 2 RegCreateKeyExA 647 402341-402349 640->647 648 40287d-40288c 640->648 649 402359-40235c 647->649 650 40234b-402358 call 4029e8 lstrlenA 647->650 653 40236c-40236f 649->653 654 40235e-40236b call 4029cb 649->654 650->649 658 402380-402394 RegSetValueExA 653->658 659 402371-40237b call 402f01 653->659 654->653 662 402396 658->662 663 402399-402475 RegCloseKey 658->663 659->658 662->663 663->648
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402333
                                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402353
                                                                                                                                                                                                        • RegSetValueExA.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040238C
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCreateValuelstrlen
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp
                                                                                                                                                                                                        • API String ID: 1356686001-2562295561
                                                                                                                                                                                                        • Opcode ID: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                                        • Instruction ID: a02971d7ffc86f6f7c629cb7da59e84f0146b185ae6196f13f615d438ff22468
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B1172B1E00108BFEB10AFA5DE8AEAF767CEB40748F10443AF505B71D1D7B99D019A68
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 665 401f51-401f5d 666 401f63-401f79 call 4029e8 * 2 665->666 667 40200b-40200d 665->667 676 401f88-401f96 LoadLibraryExA 666->676 677 401f7b-401f86 GetModuleHandleA 666->677 669 402156-40215b call 401423 667->669 675 40287d-40288c 669->675 679 401f98-401fa6 GetProcAddress 676->679 680 402004-402006 676->680 677->676 677->679 682 401fe5-401fea call 404de1 679->682 683 401fa8-401fae 679->683 680->669 687 401fef-401ff2 682->687 685 401fb0-401fbc call 401423 683->685 686 401fc7-401fdb 683->686 685->687 693 401fbe-401fc5 685->693 689 401fe0-401fe3 686->689 687->675 690 401ff8-401fff FreeLibrary 687->690 689->687 690->675 693->687
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        • LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00401FF9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • 08bcc5cf9e3fc589107741a5e999ecfa, xrefs: 00401FD1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa
                                                                                                                                                                                                        • API String ID: 2987980305-3684857273
                                                                                                                                                                                                        • Opcode ID: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                                        • Instruction ID: 0a17743dc10516c1e404603622caa6e4d13095454b29418bb929f5860ba01445
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4611D872D04115A7CF107FA4DE85EAE75B0AB44359F204237F611B62E0C77C4941965E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 694 4015b3-4015c6 call 4029e8 call 4055ca 699 4015c8-4015e3 call 405561 CreateDirectoryA 694->699 700 40160a-40160d 694->700 708 401600-401608 699->708 709 4015e5-4015f0 GetLastError 699->709 701 40162d-40215b call 401423 700->701 702 40160f-401628 call 401423 call 405a43 SetCurrentDirectoryA 700->702 716 40287d-40288c 701->716 702->716 708->699 708->700 712 4015f2-4015fb GetFileAttributesA 709->712 713 4015fd 709->713 712->708 712->713 713->708
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 004055D8
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
                                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\360GameUsers,00000000,00000000,000000F0), ref: 00401622
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360GameUsers, xrefs: 00401617
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360GameUsers
                                                                                                                                                                                                        • API String ID: 3751793516-604746571
                                                                                                                                                                                                        • Opcode ID: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                                        • Instruction ID: 6d25d20538d6d8534b6823f3fc6f17b8a3ed29de71c0eeeb3a5295b4bc58004c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B6010431908150ABDB116FB55D44D7F6BB0EA52365728063FF491B22E2C23C8942D62E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405749 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 0040575C
                                                                                                                                                                                                        • GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405776
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                        • API String ID: 1716503409-2465333807
                                                                                                                                                                                                        • Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                                        • Instruction ID: 034d2fd5f9dd90bdc64dfe9fa05123f4a2a2f766a0f29b75e345e617da869bcc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9CF0A736348204BADB104F55DC04B9B7F59DF91750F14C027FE449B1C0D6B1995897A5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402F01 Relevance: 7.6, APIs: 5, Instructions: 109fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00409190,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190,0001B9E4), ref: 00402F28
                                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000004,0001B9E4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190), ref: 00402F55
                                                                                                                                                                                                        • ReadFile.KERNEL32(004130A0,00004000,0001B9E4,00000000,00409190,?,00402EAD,000000FF,00000000,00000000,00409190,0001B9E4), ref: 00402FAF
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,004130A0,0001B9E4,000000FF,00000000,?,00402EAD,000000FF,00000000,00000000,00409190,0001B9E4), ref: 00402FC7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Read$PointerWrite
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2113905535-0
                                                                                                                                                                                                        • Opcode ID: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                                        • Instruction ID: f57f03ec19a78774be9adcd31849d1562aa90d9077fbbcd5e62cb2d9af4c63a1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D311A31901209EFDF21CF95DE44EAE7BBCEB44365F24403AF904A61E0D2749E40EB69
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402A28 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(?,?,00000000,00000000,?), ref: 00402A49
                                                                                                                                                                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A85
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402A8E
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402AB3
                                                                                                                                                                                                        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AD1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1912718029-0
                                                                                                                                                                                                        • Opcode ID: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                                        • Instruction ID: 092ce5dc9ace931e83acbc3e972042597453fb0194ad27f06f99c48de557c256
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C118971A00009FFDF21AF90DE48DAB7B39EB44384B004076BA01A01A0DB749E41EE69
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                                        • Opcode ID: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                                        • Instruction ID: d7011ec21094a782dcbe7947fab20a41340e67ab4a77a50b5f790120b2995d27
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B52183B1A44104BEDF01AFB5CE5BAAD7A75EF41704F14047EF501B61D1D6B88940D728
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0379CEAC Relevance: 6.1, APIs: 4, Instructions: 93memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __lock.LIBCMT ref: 0379CF28
                                                                                                                                                                                                        • ___sbh_alloc_block.LIBCMT ref: 0379CF34
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0379CF55
                                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000008,?,037A4AA0,0000000C,03799237,03795C66,?,00000000,00000000,00000000,?,03797512,00000001,00000214,?,03795C66), ref: 0379CF6A
                                                                                                                                                                                                          • Part of subcall function 03796742: __getptd_noexit.LIBCMT ref: 03796742
                                                                                                                                                                                                          • Part of subcall function 037966DA: __decode_pointer.LIBCMT ref: 037966E5
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocateHeap___sbh_alloc_block__decode_pointer__getptd_noexit__lock_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3771094184-0
                                                                                                                                                                                                        • Opcode ID: 6fa01b2f5423846ff49753d9b3fdf0a0a5d817d8364b9ff52e27c19c53b09e54
                                                                                                                                                                                                        • Instruction ID: 1a55cf2225d90a9fd954e8a7e766f36f36aa632df6c0cd1b6d564975d8e21ea3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6fa01b2f5423846ff49753d9b3fdf0a0a5d817d8364b9ff52e27c19c53b09e54
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA21E672A00606EFFF23EF28FC8495D7766EB85360F688727E9159B284D73185408B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
                                                                                                                                                                                                        • GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
                                                                                                                                                                                                        • VerQueryValueA.VERSION(?,0040900C,?,?,?,?,?,00000000), ref: 00401F24
                                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1404258612-0
                                                                                                                                                                                                        • Opcode ID: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                                        • Instruction ID: 5d9bf0a38514312ff05957db8cc1166864d5adc8fb1377831f0fed305f4f1e15
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E81136B2900109BEDB01EFA5D981DAEBBB9AF04344B20803AF501F61E1D7388A55DB28
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 004055D8
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 0040566A
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 0040567A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                                        • API String ID: 3248276644-3404278061
                                                                                                                                                                                                        • Opcode ID: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                                        • Instruction ID: 163ab709c3a69a1d20cf6f8253de986ede20969e143c641b36a5b73ea23f62c0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F9F0F911205D5025C72222351C09AAF0A55CD623287990E3FF858B12D1CA3D8943DC6D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004031F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00403212
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Char$Next$CreateDirectoryPrev
                                                                                                                                                                                                        • String ID: 1033$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                        • API String ID: 4115351271-3144792594
                                                                                                                                                                                                        • Opcode ID: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
                                                                                                                                                                                                        • Instruction ID: 8509fc719cfacdd3e0f19311c8db3474c91ee7b64774067ccbe91e129429c82f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75D0A92160AD3036CA613B273C0AFCF090C8F0232DF2500BBF804B00C68B6C5A8218EF
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040643F Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                                        • Instruction ID: 46f5cb6b99077c8a932221f6f95319a4d003604abf7c8fe4deea8dd62122f91f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1EA13371D00229CBEF28CFA8C8547ADBBB1FF44309F15856AD816BB281D7785A86DF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00406640 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                                        • Instruction ID: b6d6ccc853a16e4f483ba8b04077c6698ffe39116f32d6ac079e48ce0b9a1d5b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C912071D00229CBEF28CF98C844BADBBB1FF44305F15816AD816BB291D7789A86DF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00406356 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                                        • Instruction ID: 9f2062d8dd3c72469bab0aaa0c4d472ca99449d25692711e554c959146fb5a05
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F812471D00229CFEF24CFA9C8447AEBBB1FB44305F25816AD816BB281C7789985DF55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405E5B Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                                        • Instruction ID: 84f98c36384fe8ee64262c0bd4aeca6ab0d9deaaf6f503267966aff3759d9c01
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB816672D04229CBEF24CFA9C8447AEBBB0FF44305F25816AD856B7281C7785A86DF54
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004062A9 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                                        • Instruction ID: 87842c1f76f394e9967038b09935c6923b6a3569bddc7a9db877803d8644aafd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE711171D00229CFEF28CF98C844BADBBB1FB48305F15806AD816B7281D7789996DF54
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004063C7 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                                        • Instruction ID: f29c7650ca7732be42b715054819f9ef2f9a8d26a50ddb16a6e1c9f426a403c7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6712271E00229CBEF28CF99C844BAEBBB1FB44305F15806AD816B7281C7789996DF55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00406313 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                                        • Instruction ID: 150ce1bc09a2c7df66eb9a1793004520446428f7a11f196e4037732027db8909
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31712371D00229CBEF28CF98C844BAEBBB1FF44305F15806AD816B7291C7789A96DF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401B06 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GlobalFree.KERNEL32(005533C8), ref: 00401B75
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401B87
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$AllocFree
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\360GameBox\
                                                                                                                                                                                                        • API String ID: 3394109436-2767046644
                                                                                                                                                                                                        • Opcode ID: 9de469b44087ba0d09a5d89d25834fc8d6a7f36d38661a320ff8fe717dcdd15a
                                                                                                                                                                                                        • Instruction ID: 474fb9bf02499c7a6170e06d53d4e3f45d0768bb224d9c97df738da83c32a5d1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9de469b44087ba0d09a5d89d25834fc8d6a7f36d38661a320ff8fe717dcdd15a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C8219376A04500ABCB10EBA49EC5E5F73A8EB84318B24853BF211B72D1D778E9418F5D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402164 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405D3A: FindFirstFileA.KERNEL32(?,00422550,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 00405D45
                                                                                                                                                                                                          • Part of subcall function 00405D3A: FindClose.KERNEL32(00000000), ref: 00405D51
                                                                                                                                                                                                        • lstrlenA.KERNEL32 ref: 004021A4
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000), ref: 004021AE
                                                                                                                                                                                                        • SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004021D6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1486964399-0
                                                                                                                                                                                                        • Opcode ID: 18aa7cd3e417ba4bc43fa20d4712fd95ab3ac255d7fe495c772ce9c85d11a4c8
                                                                                                                                                                                                        • Instruction ID: dfadddd3a7f149e4ab042d507dd47a346d6480a4d468a4495373b54fbb4845f7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 18aa7cd3e417ba4bc43fa20d4712fd95ab3ac255d7fe495c772ce9c85d11a4c8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D115271E04304ABCB10EFF69949A9EB7F8AF14344F10453BA504FB2D1D6BCC9008B59
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405D61 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 310444273-0
                                                                                                                                                                                                        • Opcode ID: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                                        • Instruction ID: 632a00fb12e3cb8d7b800c8c05c00ea1272b68564f45bf1eadf202890d1355d3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AE08C32A04611ABC7115B20AD0897B73A8EED9B41304493EF909F6290D734AC11ABBA
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004035A6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035B8
                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035CC
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\, xrefs: 004035D7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\
                                                                                                                                                                                                        • API String ID: 2962429428-3382440817
                                                                                                                                                                                                        • Opcode ID: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                                        • Instruction ID: f9564199049be1f32d817ae5fae54506e28515e34a5cdd4db7d8b8eaa5d9f10b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE0C230904A10A6C630AF3CBE499063A6C6B413317244B26F174F21F1C778AE428AA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004023A1 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                                        • RegQueryValueExA.KERNEL32(00000000,00000000,?,000003FF,?,?,?,?,00000033), ref: 004023D1
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                        • Opcode ID: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                                        • Instruction ID: 761649a6a3df08df281199264971948c500f78b60f5aa5b2cb2b090958000ad5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 85118271A05205EFDB15CFA4CA4C9AE7BB4EF10354F20807FE441B72C0D6B88A45EB26
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                        • Opcode ID: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                                        • Instruction ID: d0f03140fbd629d0c0bf1accbe8acf671ec28544698acb2ee9a16026c0f47d2e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F01F431B24210ABE7295B389D04B2A36ADE710315F10423BF855F66F1D67CDC028B4D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402299 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                                        • RegDeleteValueA.KERNEL32(00000000,00000000,00000033), ref: 004022B8
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 004022C1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseDeleteOpenValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 849931509-0
                                                                                                                                                                                                        • Opcode ID: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                                        • Instruction ID: c96301186d0cc23108267263ea3d95e678ff255433b24e802bfd10008ffd0a7a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7F06273B00110ABDB20BBE59F4EAAE6268AB40355F10453FF101B71D1DAFD8D41976E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040571A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                                        • Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                                        • Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(?,00405506,?,?,?), ref: 004056FF
                                                                                                                                                                                                        • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405711
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                        • Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                                        • Instruction ID: 1a0f39e157c28011d0f8c1384ae394ffa0e61bdf00c6ebf87dc07efa44195b5a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 16C04CB1818506ABD6056B24DF0D81F7B66EF90321B108B35F569E00F0C7355C66EE1A
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037C3EE5 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,?,?,?,10012E77), ref: 037C3FCC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000003.2172820667.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037C0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_3_37c0000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                                                                        • Opcode ID: 6f13b2ab9fb6165f90046a6ae6433f02be2c231ce190419e4ab0d48d55e1bd3a
                                                                                                                                                                                                        • Instruction ID: fe083a8cb2643716ff109aaa35d8cab1b12f6d4f5e9e7c7e9e9c18473bf03b40
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f13b2ab9fb6165f90046a6ae6433f02be2c231ce190419e4ab0d48d55e1bd3a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F721F736A10294EBFB10EF65DC45B9EF7B4EB00724F18891DF824EB2C0C778E9418A54
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037C624F Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapDestroy.KERNELBASE(?,?,037C44F1,037C4545,?,?,?), ref: 037C62EE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000003.2172820667.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037C0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_3_37c0000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DestroyHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2435110975-0
                                                                                                                                                                                                        • Opcode ID: 6f0eb917967cca3df26654e3795574d3b611a362fb12abc9e5791fead8870b4e
                                                                                                                                                                                                        • Instruction ID: 8bb5f2a476754b00a74ef67e23ae6c77cc38f62f6201c5993eff199ac5373554
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f0eb917967cca3df26654e3795574d3b611a362fb12abc9e5791fead8870b4e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A5116136250260ABFA22DF10DCC5F19B7A5F741761F2A8429F641A7170CAB6E801CB18
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037C61F2 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapCreate.KERNEL32(00000000,00001000,00000000,037C444B,00000001), ref: 037C6203
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000003.2172820667.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037C0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_3_37c0000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                                        • Opcode ID: deedb0c4f085d02b08d532a7f1387672c145a253e8a55085e66ba4eee07c0b2b
                                                                                                                                                                                                        • Instruction ID: 9519feb150aad2519085f5a647fa2a914d4711ada6d28db3a444fff643ac78ea
                                                                                                                                                                                                        • Opcode Fuzzy Hash: deedb0c4f085d02b08d532a7f1387672c145a253e8a55085e66ba4eee07c0b2b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FAF06D746303919AEB20EB309CC97392BD9FB40782F1C883EF505C90A4EFB8C0819511
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402215 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040224E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PrivateProfileStringWrite
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 390214022-0
                                                                                                                                                                                                        • Opcode ID: c2927475e9497a9ba1c08db410f4359770c011c1dbe4487c89ce767d200da861
                                                                                                                                                                                                        • Instruction ID: c3e28f33354a9bdeaec00bb895c317f9eff9eaea502077a7dac98389f1c24f9d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2927475e9497a9ba1c08db410f4359770c011c1dbe4487c89ce767d200da861
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CEE04F71B401256BDF507AF14E8E97F1098AB89304F64067FB601B63E2D9BC4D01826A
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402AF2 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                                        • Opcode ID: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                                        • Instruction ID: 62d85545fb8c015d315058fdcb0d0d57892fb31d87e90ba3457693cc688901e8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46E086B6240108BFDB00DFA4ED47F9577ECF704301F004421B608D70A2C774E5408B58
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004031A8 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000000,00000000,00000000,004130A0,0040B0A0,004030AD,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000), ref: 004031BF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                                        • Opcode ID: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                                        • Instruction ID: b8f1ad64850fa721b7c3123cc302f733781f6218d307da9d2aa6486ecc23217a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4BE08632254119BBCF105E619C00AD73F5CEB0A3A2F008432FD55E9190D230EA11DBA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03799D26 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapCreate.KERNEL32(00000000,00001000,00000000,?,037960FE,00000001,?,?,?,03796277,?,?,?,037A46F0,0000000C,03796332), ref: 03799D3B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                                        • Opcode ID: 8750286ff3ac701c2ccc5612a0e730b3417fc04989c132f63f48ec46cc030afe
                                                                                                                                                                                                        • Instruction ID: c23cbbc969612c9fbcb61f89c62d9f864bb468c159bbbb716092aedb9839880c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8750286ff3ac701c2ccc5612a0e730b3417fc04989c132f63f48ec46cc030afe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 49D05E3265070A9AEB01AE75B808B663BEC93C5295F04C476BA0CC6184F678C550DA04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037C75D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • TlsFree.KERNEL32(100115B0,037C44EC,037C4545,?,?,?), ref: 037C75E0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000003.2172820667.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037C0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_3_37c0000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Free
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3978063606-0
                                                                                                                                                                                                        • Opcode ID: 3c298c4fbd44a8207be02205b8afb5583fedf16ed390c409380dac2476bd8d9d
                                                                                                                                                                                                        • Instruction ID: 32e25f737387cf3ced3731592913f2a7944f6c42aa5ad9fb5209216d879f90f6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c298c4fbd44a8207be02205b8afb5583fedf16ed390c409380dac2476bd8d9d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6FC04C74414A909BE618A7389C8E448366776813703944708E0B3C50F1EB74D4424A14
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004031DA Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,0001B9E4), ref: 004031E8
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                        • Opcode ID: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                                        • Instruction ID: 0cdacc43d416a0c3c320ce55ce8d4373a9ea66752a7e2c64ddc4eeaf6ba3fa4d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 49B01271644200BFDA214F00DF05F057B31B790700F108430B394380F082712420EB0D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03791317 Relevance: 1.3, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03791330
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeVirtual
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1263568516-0
                                                                                                                                                                                                        • Opcode ID: 0a5803c29d0adb4a0837b0b544cd1f99828cc6346f0f6f9bec770df721ac8727
                                                                                                                                                                                                        • Instruction ID: 7b271062d6ae68b061f1de2775a69e1a9127643c8b7844ef2ddf1b96c6975366
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0a5803c29d0adb4a0837b0b544cd1f99828cc6346f0f6f9bec770df721ac8727
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F4E09275B4430ACBDF28DFA4EC827AEB770FB48720F50425AED1657780DB3469108A50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 00404730 Relevance: 67.0, APIs: 33, Strings: 5, Instructions: 478windowmemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404747
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404754
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000003), ref: 004047A0
                                                                                                                                                                                                        • LoadBitmapA.USER32(0000006E), ref: 004047B3
                                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000FC,00404D31), ref: 004047CD
                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047E1
                                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004047F5
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 0040480A
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404816
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404828
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0040482D
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404858
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404864
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 004048F9
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404924
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404938
                                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404967
                                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404975
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404986
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A89
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404AEE
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404B03
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404B27
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B4D
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00404B62
                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00404B72
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404BE2
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C8B
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C9A
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404CBA
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00404D08
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404D13
                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00404D1A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                        • String ID: $M$N$W7L$/K
                                                                                                                                                                                                        • API String ID: 1638840714-4285310889
                                                                                                                                                                                                        • Opcode ID: 00d5072151e125040d91cee365c37ddb3e44aab28ca38f45cf86c1e1437003a2
                                                                                                                                                                                                        • Instruction ID: 2f002745dd727b88aea6b3014e5fe59d6d497abb36422f7ee26b5b217c9fe0ee
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 00d5072151e125040d91cee365c37ddb3e44aab28ca38f45cf86c1e1437003a2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83028BB0A40209EFDB24DF64DD45AAE7BB5FB84315F10813AF610BA2E1C7799A41CF58
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404F1F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 278windowclipboardmemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 00404F7E
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00404F8D
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00404FCA
                                                                                                                                                                                                        • GetSystemMetrics.USER32(00000015), ref: 00404FD2
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404FF3
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405004
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405017
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405025
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405038
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040505A
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040506E
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040508F
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040509F
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004050B8
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004050C4
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 00404F9C
                                                                                                                                                                                                          • Part of subcall function 00403E6C: SendMessageA.USER32(00000028,?,00000001,00403C9D), ref: 00403E7A
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004050E1
                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00004EB3,00000000), ref: 004050EF
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004050F6
                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040511A
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000008), ref: 0040511F
                                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 00405166
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405198
                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004051A9
                                                                                                                                                                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004051BE
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 004051D1
                                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004051F5
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405230
                                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 00405240
                                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405246
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 0040524F
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405259
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040526D
                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405285
                                                                                                                                                                                                        • SetClipboardData.USER32(00000001,00000000), ref: 00405290
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 00405296
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                        • String ID: {$/K
                                                                                                                                                                                                        • API String ID: 590372296-1044373371
                                                                                                                                                                                                        • Opcode ID: f674280dbd773ff570a4733b74376f1be0f8e9295ca65a1d177e19aa462aa4e6
                                                                                                                                                                                                        • Instruction ID: 54a7b5396bae693a6587d4a30afce820365ed4185083f78a013f57a3a1aa2e37
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f674280dbd773ff570a4733b74376f1be0f8e9295ca65a1d177e19aa462aa4e6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FDA14A70900208BFDB219F60DD89AAE7F79FB04355F00417AFA05BA2A0C7795E519F99
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404275 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 242stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 004042C0
                                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,?), ref: 004042EC
                                                                                                                                                                                                        • SHBrowseForFolderA.SHELL32(?,0041F8D0,?), ref: 004043A1
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 004043AC
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00422EA0,00420500), ref: 004043DE
                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,00422EA0), ref: 004043EA
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 004043FA
                                                                                                                                                                                                          • Part of subcall function 004052E8: GetDlgItemTextA.USER32(?,?,00000400,00404430), ref: 004052FB
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                                        • GetDiskFreeSpaceA.KERNEL32(0041F4C8,?,?,0000040F,?,00000000,0041F4C8,0041F4C8,?,?,000003FB,?), ref: 0040449D
                                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044B3
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(00000000,00000400,0041F4B8), ref: 00404507
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa$A$C:\Users\user\AppData\Local\360GameBox$W7L$/K
                                                                                                                                                                                                        • API String ID: 2246997448-2735981980
                                                                                                                                                                                                        • Opcode ID: 15dfb5f5222a7c90f574cdaf83bfc2db8a2ded6642e2795df1bb2acfe9a11056
                                                                                                                                                                                                        • Instruction ID: 735228c1dd8b1f81b04b8bc6f92d9a1389f0a941abf34816bf15e20d5babff8a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 15dfb5f5222a7c90f574cdaf83bfc2db8a2ded6642e2795df1bb2acfe9a11056
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7817DB1A00218BBDB11AFA1DD45A9F7BB8EF44314F10813BFA04B62D1C77C9A41CB69
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0379579A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 03796846
                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0379685B
                                                                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(037A270C), ref: 03796866
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(C0000409), ref: 03796882
                                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 03796889
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2579439406-0
                                                                                                                                                                                                        • Opcode ID: a2d3c3b357920a9010982a431a9df1a2457e87099e1e343add7b9efcb1aa9163
                                                                                                                                                                                                        • Instruction ID: 088c4780a44757e28698598007ee188f35467cfaa20c28c041c76f1c4b13b853
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a2d3c3b357920a9010982a431a9df1a2457e87099e1e343add7b9efcb1aa9163
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8821E3B8802A08EFD754FF68F488A457FF5FB88311F14C59AE90987249EB785581DF06
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402012 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402065
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,0040A808,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040211F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360GameUsers, xrefs: 0040209D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360GameUsers
                                                                                                                                                                                                        • API String ID: 123533781-604746571
                                                                                                                                                                                                        • Opcode ID: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                                        • Instruction ID: 9b89665ae90dc8b4180d3c8d33d84192eed4ab63dd5a898af4d907ee2c273e32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F0416FB5A00104AFDB00DFA4CD89E9E7BB9EF49314B20416AF905EB2D1CA79DD41CB64
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402630 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040263F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                                        • Opcode ID: 8421a41e1df0c9106172ed25bea93ee113a2d5f9eb36866c73187df20ada77dd
                                                                                                                                                                                                        • Instruction ID: f1be7f5fbd37878f4f010312c241429cf920c65d46553418e9b7b5770661ac32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8421a41e1df0c9106172ed25bea93ee113a2d5f9eb36866c73187df20ada77dd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5EF0A7726041109FD700EBB59D49EEE7768DF51324F6006BBE111F20C1C3B88A429A2A
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403964 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039A0
                                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 004039BD
                                                                                                                                                                                                        • DestroyWindow.USER32 ref: 004039D1
                                                                                                                                                                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 004039ED
                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403A0E
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A22
                                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403A29
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403AD7
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403AE1
                                                                                                                                                                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403AFB
                                                                                                                                                                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B4C
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403BF2
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00403C13
                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C25
                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C40
                                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C56
                                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00403C5D
                                                                                                                                                                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C75
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C88
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,?,00420500,00423700), ref: 00403CB1
                                                                                                                                                                                                        • SetWindowTextA.USER32(?,00420500), ref: 00403CC0
                                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 00403DF4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 184305955-0
                                                                                                                                                                                                        • Opcode ID: aa9795fc97d7b7231353da3c5581c78f3c664ab19e9876cbfe237abc519f2bc8
                                                                                                                                                                                                        • Instruction ID: 7ba81dbe19c60a8e0c3243ea337059b00a2b0f070469454242f3f43eb6e2cd92
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa9795fc97d7b7231353da3c5581c78f3c664ab19e9876cbfe237abc519f2bc8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36C1A271A04204BBD7206F61ED49E2B7EBCEB45706F40053EF541B12E1C779AA429F6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403F7F Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040400A
                                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 0040401E
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040403C
                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040404D
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040405C
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040406B
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 00404075
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404083
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404092
                                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 004040F5
                                                                                                                                                                                                        • SendMessageA.USER32(00000000), ref: 004040F8
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404123
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404163
                                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 00404172
                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040417B
                                                                                                                                                                                                        • ShellExecuteA.SHELL32(0000070B,open,00422EA0,00000000,00000000,00000001), ref: 0040418E
                                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 0040419B
                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040419E
                                                                                                                                                                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 004041CA
                                                                                                                                                                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 004041DE
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                                                                                                                        • String ID: K?@$N$W7L$open$/K
                                                                                                                                                                                                        • API String ID: 3615053054-1886668895
                                                                                                                                                                                                        • Opcode ID: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                                        • Instruction ID: a34f9f388cf178df8091a403f6a11dec50c515965b2aee4463b3b7977a12a790
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5461C2B1A40209BFEB109F60DD45B6A7BA9FB54705F108136FB04BA2D1C7B8A951CF98
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                        • SetTextColor.GDI32(00000000,?), ref: 00401130
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                        • DrawTextA.USER32(00000000,Function_00023700,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                        • String ID: F$/K
                                                                                                                                                                                                        • API String ID: 941294808-4153089001
                                                                                                                                                                                                        • Opcode ID: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                                        • Instruction ID: ae885c784bcfecf2f3eb694ec281fa6ca416ae0fe75479e663ed1437ea50fae5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B419A71804249AFCB058FA5DD459BFBFB9FF44315F00812AF951AA1A0C738AA50DFA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03792CB0 Relevance: 22.7, APIs: 15, Instructions: 188stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792CD8
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792CEC
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792D04
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792D24
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792D38
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792D50
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792D70
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792D84
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792D9C
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792DBC
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792DD0
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792DE8
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792E03
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792E17
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792E2F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide__alloca_probe_16lstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3660014924-0
                                                                                                                                                                                                        • Opcode ID: 6b6334bcebfe8ba6b78daac14364781ead812da33583f44bf67f0a6477288fbf
                                                                                                                                                                                                        • Instruction ID: 9caa5b1cf2170c1a19ccd81745b4ff975dd21726ba38f37896f509c6d223bc9f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6b6334bcebfe8ba6b78daac14364781ead812da33583f44bf67f0a6477288fbf
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0451DA75A1561DBBEF10FF34DC85DBB7BB8EF45664B140B2AED21E7185E630890087A0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03797400 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,037A47B0,0000000C,0379753B,00000000,00000000,?,03795C66,?,?,?,?), ref: 03797412
                                                                                                                                                                                                        • __crt_waiting_on_module_handle.LIBCMT ref: 0379741D
                                                                                                                                                                                                          • Part of subcall function 037992BB: Sleep.KERNEL32(000003E8,?,?,03797363,KERNEL32.DLL,?,03798426,?,03797A14,03795C66,?,?,03795C66,?), ref: 037992C7
                                                                                                                                                                                                          • Part of subcall function 037992BB: GetModuleHandleW.KERNEL32(03795C66,?,03797363,KERNEL32.DLL,?,03798426,?,03797A14,03795C66,?,?,03795C66,?,?,?,?), ref: 037992D0
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 03797446
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,DecodePointer), ref: 03797456
                                                                                                                                                                                                        • __lock.LIBCMT ref: 03797478
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(89A5F3E0), ref: 03797485
                                                                                                                                                                                                        • __lock.LIBCMT ref: 03797499
                                                                                                                                                                                                        • ___addlocaleref.LIBCMT ref: 037974B7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                                                        • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                                        • API String ID: 1028249917-2843748187
                                                                                                                                                                                                        • Opcode ID: 95c5575e554462a7748332c69785f0112a69ff53bddf65fda8d8a5b3827ddfab
                                                                                                                                                                                                        • Instruction ID: 531b7127bf01fe150dd8f46df27a413d7f9dfd3857110e380bd035706869f41a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 95c5575e554462a7748332c69785f0112a69ff53bddf65fda8d8a5b3827ddfab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D11B775500B44DEFB50EF39E844B4EBBF0AF45310F108A5ED5A9972A1CB749641DF60
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03792B30 Relevance: 18.2, APIs: 12, Instructions: 156stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792B58
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792B6C
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792B84
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792BA4
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792BB8
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792BD0
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792BF0
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792C04
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792C1C
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792C37
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792C4B
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792C63
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide__alloca_probe_16lstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3660014924-0
                                                                                                                                                                                                        • Opcode ID: 1519257d3b8a7fd54ef950c57cc8a64239d6e456dde32000572982560b9d8f1e
                                                                                                                                                                                                        • Instruction ID: 4d1f853a2e41aea90bffcfcd0dac48f16574d2663096cf9f629a3129152de772
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1519257d3b8a7fd54ef950c57cc8a64239d6e456dde32000572982560b9d8f1e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: ED41D879A11619BBEF10FF34EC85AAB77E8EB45224B144B29ED21D7281E6308900C7A0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037C4DEB Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 476COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000003.2172820667.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037C0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_3_37c0000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __aulldiv__aullrem
                                                                                                                                                                                                        • String ID: $'$9$@$g$g
                                                                                                                                                                                                        • API String ID: 3839614884-2311196974
                                                                                                                                                                                                        • Opcode ID: 32eb65f0e083e61c1061ebccd3c14f028ad4b35eecad9f92a2c8a45571e89fc4
                                                                                                                                                                                                        • Instruction ID: 46893fdeeb257edd1f9fd6432bdcb40aab66c6b5b3c5b1e278666c94a1322203
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32eb65f0e083e61c1061ebccd3c14f028ad4b35eecad9f92a2c8a45571e89fc4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87028E71C25289EBDF11CFAAC9487FDBBB4AF06324F18419DD810AA290D776A641DB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037C5A2B Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 469COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000003.2172820667.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037C0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000003.2172820667.00000000037D6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_3_37c0000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __aulldiv__aullrem
                                                                                                                                                                                                        • String ID: $'$9$@$g$g
                                                                                                                                                                                                        • API String ID: 3839614884-2311196974
                                                                                                                                                                                                        • Opcode ID: 1c7b34b760220bdc0d9568fbf2ef25f70dab37a4dbe3aa30143ccc2fedc39704
                                                                                                                                                                                                        • Instruction ID: 13137c2c4d46f705c1c5f23462e84ffc57e82319c3292a5b6bddba32eadf0dc9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c7b34b760220bdc0d9568fbf2ef25f70dab37a4dbe3aa30143ccc2fedc39704
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AF02A271C21389EEDF14CF9AC9887EDBBB4EF06324F18419DD810AA290D776AA45DF50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03794ED0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 03794EF9
                                                                                                                                                                                                        • CoCreateInstance.OLE32(037A25C0,00000000,00000017,037A236C,?,?,00000001,?,00000000,?,00000001,?,?), ref: 03794F12
                                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 03794F21
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03794F93
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03794FEC
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03795010
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 0379501F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Variant$Clear$CreateInitInitializeInstance
                                                                                                                                                                                                        • String ID: \360safe
                                                                                                                                                                                                        • API String ID: 4078678525-3015847306
                                                                                                                                                                                                        • Opcode ID: c655f77da9825c559d1049ed283e9962e69b8934c37cff3afb554f81281770fa
                                                                                                                                                                                                        • Instruction ID: 43a9cfc7bb867dd621d8465942b5aa8c9d28adf7b77826ca6223e998fc376299
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c655f77da9825c559d1049ed283e9962e69b8934c37cff3afb554f81281770fa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19414B756047019FD700EF29D848A16BBE8FF8D710F458A99F9459B352D734E805CFA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03792970 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 44registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0379297C
                                                                                                                                                                                                        • LoadCursorA.USER32 ref: 037929A0
                                                                                                                                                                                                        • RegisterClassExA.USER32(00000000), ref: 037929D0
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 037929DB
                                                                                                                                                                                                        • CreateWindowExA.USER32(00000000,SetupHelper,MsgWnd,00C00000,00000000,00000000,00000064,00000064,00000000,00000000,03790000,00000000), ref: 03792A0D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassCreateCursorErrorLastLoadRegisterWindow_memset
                                                                                                                                                                                                        • String ID: 0$MsgWnd$SetupHelper
                                                                                                                                                                                                        • API String ID: 2096449335-1162629927
                                                                                                                                                                                                        • Opcode ID: 268a821504d6f1efe469f0a045b13a265c6913bbe3b5bd4e400c81c66a5968a6
                                                                                                                                                                                                        • Instruction ID: 6a16b980bbdd32c44a8f22dd1a33edcf1d7eecc5e176886c5291db16a685d758
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 268a821504d6f1efe469f0a045b13a265c6913bbe3b5bd4e400c81c66a5968a6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C01B5B4288701BBF314EF50DC4AF0A7FE4ABC4B08F508A18F6587A1C6D6B85114CB9B
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405CA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                                        • CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                                        • CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                                        • CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405CA2, 00405CDD
                                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S, xrefs: 00405CA7
                                                                                                                                                                                                        • *?|<>/":, xrefs: 00405CE9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                        • API String ID: 589700163-2013987220
                                                                                                                                                                                                        • Opcode ID: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                                        • Instruction ID: 5f153727bab28e9e0146d4b5ee00b331a23ca9fa80731b33480d586dfd6bff40
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A119055808F912AFB3216245C44BB77F99CF567A0F28847BE5C4632C2C67C5C429B6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402B2D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 36timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B48
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402B7C
                                                                                                                                                                                                        • SetWindowTextA.USER32(?,?), ref: 00402B8C
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402B9E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                        • String ID: unpacking data: %d%%$verifying installer: %d%%$/K
                                                                                                                                                                                                        • API String ID: 1451636040-2710919394
                                                                                                                                                                                                        • Opcode ID: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                                        • Instruction ID: c2ae3dc6e7ef4d7981284b04d028e8b0241bece3c18d328e79a1d4abe5e5a81b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DBF01270900109ABEB219F50DD09BAE3779AB04345F00803AFA16B91D1D7B95A559B99
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403E9E Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000EB), ref: 00403EBB
                                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 00403ED7
                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00403EE3
                                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 00403EEF
                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 00403F02
                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 00403F12
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00403F2C
                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00403F36
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                                        • Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                                        • Instruction ID: 00f1469000c5a89127aeec98ef40b5380c975c6b17ce5fce2ee989e1a8c22914
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9216271904745ABCB219F68DD08B5BBFF8AF01715B048A69F895E22E1C738E9048B55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037934A0 Relevance: 10.7, APIs: 7, Instructions: 156windowsleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 03792970: _memset.LIBCMT ref: 0379297C
                                                                                                                                                                                                          • Part of subcall function 03792970: LoadCursorA.USER32 ref: 037929A0
                                                                                                                                                                                                          • Part of subcall function 03792970: RegisterClassExA.USER32(00000000), ref: 037929D0
                                                                                                                                                                                                          • Part of subcall function 03792970: GetLastError.KERNEL32 ref: 037929DB
                                                                                                                                                                                                        • LoadIconA.USER32(03790000,00000065), ref: 037934CB
                                                                                                                                                                                                        • _memset.LIBCMT ref: 037934DF
                                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32 ref: 037935AB
                                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000001,000001F8), ref: 03793665
                                                                                                                                                                                                        • Sleep.KERNEL32(?), ref: 0379366F
                                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000002,000001F8), ref: 0379367C
                                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 03793683
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Icon$NotifyShell_$Load_memset$ClassCursorDestroyErrorLastRegisterSleepWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3764287842-0
                                                                                                                                                                                                        • Opcode ID: 465ae3dac1185debe88dab959bdbc1346b43afc13917a6dd55a706c884eb47f8
                                                                                                                                                                                                        • Instruction ID: d5dae423d825fbd9e489f779d3c860678618bf79ed0717ab6cb50f088b651458
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 465ae3dac1185debe88dab959bdbc1346b43afc13917a6dd55a706c884eb47f8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E75107785083418FFB26CF28D5487ABBBE9FFC9704F184A5EE4868B385D77495088792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037936B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000000,00020019,?), ref: 037936F7
                                                                                                                                                                                                        • _memset.LIBCMT ref: 03793729
                                                                                                                                                                                                        • StrStrA.SHLWAPI(?,?,PendingFileRenameOperations,?,?), ref: 03793765
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,PendingFileRenameOperations,?,?), ref: 0379378D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • PendingFileRenameOperations, xrefs: 0379373B
                                                                                                                                                                                                        • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 037936DF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpen_memset
                                                                                                                                                                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
                                                                                                                                                                                                        • API String ID: 17851891-3023217399
                                                                                                                                                                                                        • Opcode ID: 6dac4ff3396934c6cb574715e0ab87f4a433b04fd05e7d4522251c8b04a27a27
                                                                                                                                                                                                        • Instruction ID: 0b7a73a576139a4610e566e77b9ef029f6d5ca3bbe03005b3044355d1fc28d03
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6dac4ff3396934c6cb574715e0ab87f4a433b04fd05e7d4522251c8b04a27a27
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D8217EB6508304ABFB10EE18ACC48AFF7D8EB88344F484B2EF54993151D730DA448B92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404DE1 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                        • lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                        • SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2531174081-0
                                                                                                                                                                                                        • Opcode ID: c759d5bcfee361b0ca538f64dd674f8afe2e15b12f95dc75770de0e433f21ee7
                                                                                                                                                                                                        • Instruction ID: 2cf2fc7e43d6ef2041dab6756eebc4073d6c30a41a9daa52e20b0ba15f173232
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c759d5bcfee361b0ca538f64dd674f8afe2e15b12f95dc75770de0e433f21ee7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94217CB1A00108BECB119FA5CD84ADFBFB9FB44354F14807AFA04A6290C3388E419F98
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004046B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004046CB
                                                                                                                                                                                                        • GetMessagePos.USER32 ref: 004046D3
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 004046ED
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 004046FF
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404725
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                                        • Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                                        • Instruction ID: 0faaf10df4b3c5b013205b28b163586d08db614e614b64859ce527e54ea6c82f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D014071D00219BADB01DBA4DD45BEEBBB8AB55711F10412AFA10B71C0D7B469018B95
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03792E80 Relevance: 9.1, APIs: 6, Instructions: 89stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792EA8
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792EBC
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792ED4
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03792EEF
                                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03792F03
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03792F1B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide__alloca_probe_16lstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3660014924-0
                                                                                                                                                                                                        • Opcode ID: 7ecbfb193afdba3886b4f3101b73fe9db5530f2db0a731a7d4751a54fca92a41
                                                                                                                                                                                                        • Instruction ID: 7ba59744fb15459ce73513da88fcf2dbb0e62dc253f0a6e0ef4b4010e7818fcb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ecbfb193afdba3886b4f3101b73fe9db5530f2db0a731a7d4751a54fca92a41
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4521EA79A1161CFBEF10FF74EC899BB77A9DB45220B24472AED11D7181E6308D00C790
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0379879E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CreateFrameInfo.LIBCMT ref: 037987C6
                                                                                                                                                                                                          • Part of subcall function 03795FE4: __getptd.LIBCMT ref: 03795FF2
                                                                                                                                                                                                          • Part of subcall function 03795FE4: __getptd.LIBCMT ref: 03796000
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 037987D0
                                                                                                                                                                                                          • Part of subcall function 03797560: __getptd_noexit.LIBCMT ref: 03797563
                                                                                                                                                                                                          • Part of subcall function 03797560: __amsg_exit.LIBCMT ref: 03797570
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 037987DE
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 037987EC
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 037987F7
                                                                                                                                                                                                        • _CallCatchBlock2.LIBCMT ref: 0379881D
                                                                                                                                                                                                          • Part of subcall function 03796089: __CallSettingFrame@12.LIBCMT ref: 037960D5
                                                                                                                                                                                                          • Part of subcall function 037988C4: __getptd.LIBCMT ref: 037988D3
                                                                                                                                                                                                          • Part of subcall function 037988C4: __getptd.LIBCMT ref: 037988E1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1602911419-0
                                                                                                                                                                                                        • Opcode ID: 0614a222c5c537f075ee3d57e2c36a241565363378655c6624eef0ff5c69adaf
                                                                                                                                                                                                        • Instruction ID: b0efb03bcf3900e2b710c94ce0e594ee75bea402fe5d17af87e2244932ce9d7d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0614a222c5c537f075ee3d57e2c36a241565363378655c6624eef0ff5c69adaf
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71111C75C10309DFEF00EFA4D448ADE7BB0FF04310F10826AE814AB250DB3999149F50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403897 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,00423700), ref: 0040392F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: TextWindow
                                                                                                                                                                                                        • String ID: 1033$C:\Users\user\AppData\Local\Temp\$W7L$/K
                                                                                                                                                                                                        • API String ID: 530164218-1309259612
                                                                                                                                                                                                        • Opcode ID: a2d008e39f389681bd3f84ce19f2f791124a33e6f2f80e92008ba66b1dfddce4
                                                                                                                                                                                                        • Instruction ID: 2adf9cbe04a35390a97661ff7fb7b78584b9eec01914685aa61950304d63ee05
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a2d008e39f389681bd3f84ce19f2f791124a33e6f2f80e92008ba66b1dfddce4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A911CFB1F046119BC734AF15EC809377BBDEB88726369817BE901A73D1C63D9A029A58
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000), ref: 00402BDD
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402BFB
                                                                                                                                                                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402B2D,00000000), ref: 00402C4D
                                                                                                                                                                                                          • Part of subcall function 00402BA9: MulDiv.KERNEL32(00000000,00000064,?), ref: 00402BBE
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402C29
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Windowlstrlen$CountCreateDestroyDialogParamTextTicklstrcatwsprintf
                                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                                        • API String ID: 632923820-2449383134
                                                                                                                                                                                                        • Opcode ID: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                                        • Instruction ID: f5379eef49564d08d05b70d449bc26bfa371e2d4fe50783bab2c047c33a3c2e3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A01927090D225EBDB216F55EE4C99F7B78AB04701B104137F401B12D5C6BCA986CBAE
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037984ED Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 03798507
                                                                                                                                                                                                          • Part of subcall function 03797560: __getptd_noexit.LIBCMT ref: 03797563
                                                                                                                                                                                                          • Part of subcall function 03797560: __amsg_exit.LIBCMT ref: 03797570
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 03798518
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 03798526
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID: MOC$csm
                                                                                                                                                                                                        • API String ID: 803148776-1389381023
                                                                                                                                                                                                        • Opcode ID: c66440dd2a2d93f0209224d2705016ad210aaab4b5b6b68ba6c2cda2ba3fd108
                                                                                                                                                                                                        • Instruction ID: 5fed444f88ebc6c4cd984f9ced2c9911bd4c7062ba132faea1faf6bf0475ecc8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c66440dd2a2d93f0209224d2705016ad210aaab4b5b6b68ba6c2cda2ba3fd108
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 55E04F79510708DFFF14EB68F089B283798EB4A255F1942A7D40DCB322E734D4449653
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03796AB7 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 03796AC3
                                                                                                                                                                                                          • Part of subcall function 03797560: __getptd_noexit.LIBCMT ref: 03797563
                                                                                                                                                                                                          • Part of subcall function 03797560: __amsg_exit.LIBCMT ref: 03797570
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 03796AE3
                                                                                                                                                                                                        • __lock.LIBCMT ref: 03796AF3
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 03796B10
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(038916B0), ref: 03796B3B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4271482742-0
                                                                                                                                                                                                        • Opcode ID: 77ae72a026ade3a414da9e746703e14154752fe636bab86bca1542a2bf5c4cf7
                                                                                                                                                                                                        • Instruction ID: 688b7b5d23d379d684b787ec3c52deb5aa730e9f7f33a5e8ba0b82af5f2680ab
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 77ae72a026ade3a414da9e746703e14154752fe636bab86bca1542a2bf5c4cf7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A501A135A01B109BFE10FB65B44975DB7A0EB45B21F1D835FE8146B284DB385840DBD1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03796370 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __lock.LIBCMT ref: 0379638E
                                                                                                                                                                                                          • Part of subcall function 0379A314: __mtinitlocknum.LIBCMT ref: 0379A32A
                                                                                                                                                                                                          • Part of subcall function 0379A314: __amsg_exit.LIBCMT ref: 0379A336
                                                                                                                                                                                                          • Part of subcall function 0379A314: EnterCriticalSection.KERNEL32(?,?,?,0379CF2D,00000004,037A4AA0,0000000C,03799237,03795C66,?,00000000,00000000,00000000,?,03797512,00000001), ref: 0379A33E
                                                                                                                                                                                                        • ___sbh_find_block.LIBCMT ref: 03796399
                                                                                                                                                                                                        • ___sbh_free_block.LIBCMT ref: 037963A8
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,03795C66,037A4710,0000000C,0379A2F5,00000000,037A4A40,0000000C,0379A32F,03795C66,?,?,0379CF2D,00000004,037A4AA0,0000000C), ref: 037963D8
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0379CF2D,00000004,037A4AA0,0000000C,03799237,03795C66,?,00000000,00000000,00000000,?,03797512,00000001,00000214), ref: 037963E9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2714421763-0
                                                                                                                                                                                                        • Opcode ID: 946af2154f161a3e34ded848dcb9e54cafa284f8606cc2e6d897d59e9756a02e
                                                                                                                                                                                                        • Instruction ID: e4d87df893173a6aef93b318723e807f27dd06df97b04e3fbd4fbfd1a7e289bb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 946af2154f161a3e34ded848dcb9e54cafa284f8606cc2e6d897d59e9756a02e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD014B35901706AAFF24FB60B90DB5E7AA4AF4D670F14436EE910AA090CB388580AA54
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?), ref: 00401CC5
                                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401CD2
                                                                                                                                                                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D10
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                                        • Opcode ID: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                                        • Instruction ID: 73f510c38aede9d1999832a0848f44238895318cfbb720f21bd33ecac166bac3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57F0F9B2A04105BFD700EBA4EE89DAFB7BDEB44341B104476F601F21A0C7789D018B29
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004055CA Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75572EE0), ref: 004055D8
                                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                                        • String ID: C:\$|S@
                                                                                                                                                                                                        • API String ID: 3213498283-628904129
                                                                                                                                                                                                        • Opcode ID: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                                        • Instruction ID: 59c8476761b09c245942ad27e65994d154511812b78a9f1548afb2a8e03f2f93
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6F02751904E2166E73262644C04B3B979CDB95310F080837E201B71D1C2B84C82DFAE
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004045CE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,00420500,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004044EE,000000DF,?,00000000,00000400), ref: 0040465C
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00404664
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00420500), ref: 00404677
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                        • String ID: %u.%u%s%s
                                                                                                                                                                                                        • API String ID: 3540041739-3551169577
                                                                                                                                                                                                        • Opcode ID: a1f483348180a604368abe57e5e97d271cf2ba409d1936ba80aa741df01b1b7d
                                                                                                                                                                                                        • Instruction ID: 9ef1d31d43ed7f04e774dbb7b0bf9bfadd02bf4a4dcb113ad37d7c9c7133e094
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a1f483348180a604368abe57e5e97d271cf2ba409d1936ba80aa741df01b1b7d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23110473B001243BDB10A66D9C46EEF329EDBC6334F14023BF625F61D1E9789D1186A9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404D31 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00404D67
                                                                                                                                                                                                        • CallWindowProcA.USER32(?,00000200,?,?), ref: 00404DD5
                                                                                                                                                                                                          • Part of subcall function 00403E83: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403E95
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                        • String ID: $08bcc5cf9e3fc589107741a5e999ecfa
                                                                                                                                                                                                        • API String ID: 3748168415-2073574801
                                                                                                                                                                                                        • Opcode ID: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                                        • Instruction ID: ca4354f5c4b8917eef9c40a956cdd667d29c971957ea1c54f02525437b92d001
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B116D71600219BBDF21AF51EC80A9B3A69AF84365F40813BFB08651A1C7789D918FA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03798B4B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___BuildCatchObject.LIBCMT ref: 03798B5E
                                                                                                                                                                                                          • Part of subcall function 03798AB9: ___BuildCatchObjectHelper.LIBCMT ref: 03798AEF
                                                                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 03798B75
                                                                                                                                                                                                        • ___FrameUnwindToState.LIBCMT ref: 03798B83
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                        • API String ID: 2163707966-1018135373
                                                                                                                                                                                                        • Opcode ID: 8f3e6c04d4d432192232fe851b12777bca55f561a217a48fe7ced96e7c89aee0
                                                                                                                                                                                                        • Instruction ID: 22ea9021bc48141666a7fe18bca78c8e6b923084270cd08c2af787a2b9543bf7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8f3e6c04d4d432192232fe851b12777bca55f561a217a48fe7ced96e7c89aee0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9101FB75401219BBEF12AF51EC48EAA7F6AEF06350F084216FD1829120D772D971DBA6
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0379F4EE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(KERNEL32,0379E996), ref: 0379F4F3
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0379F503
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleModuleProc
                                                                                                                                                                                                        • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                                        • API String ID: 1646373207-3105848591
                                                                                                                                                                                                        • Opcode ID: 9526ded3908eb511142483b7f3d56f72792979b0d33baf210541d5d66c34186f
                                                                                                                                                                                                        • Instruction ID: 1c56f40ac81a3c6a62a01a70883587b8fef754fc5c5d5db1aebe96195c959bd0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9526ded3908eb511142483b7f3d56f72792979b0d33baf210541d5d66c34186f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2CF03021A00E0DD2EF00ABA6BD0A6AFBA78BBC0747F8646D1D196E0189DF759074F351
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004052A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422508,Error launching installer), ref: 004052C8
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 004052D5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004052A3
                                                                                                                                                                                                        • Error launching installer, xrefs: 004052B6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
                                                                                                                                                                                                        • API String ID: 3712363035-3625802312
                                                                                                                                                                                                        • Opcode ID: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                                        • Instruction ID: ecae64e874cd01a2b34c598d60022b54c52eec95b920328752207242d2311f01
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31E0ECB4A00209BBDB009F64ED09E6B7BBDEB04304F90C522A911E2190D778E9508A79
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 0040553C
                                                                                                                                                                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405545
                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C), ref: 00405556
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405536
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                        • API String ID: 2659869361-4083868402
                                                                                                                                                                                                        • Opcode ID: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                                        • Instruction ID: a8815a40c5cf52564b0ee38fd83154c3193b14c3492e6d39585f1257e3d031c0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82D0A9A2605A30BEE20232198C09E8B2A09CF02310B054422F200B62D2C2BC8E018FFE
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0379D778 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0379D7AC
                                                                                                                                                                                                        • __isleadbyte_l.LIBCMT ref: 0379D7E0
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 0379D811
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 0379D87F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3058430110-0
                                                                                                                                                                                                        • Opcode ID: c8ed5f053e8c1cca4a04f8824f8062f585fda197e4c7677ca73357158da88ac0
                                                                                                                                                                                                        • Instruction ID: 7440514ac2d35cb13462bf52bc6e5c79409663a14f84c0f47c82fe27a4b97caa
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c8ed5f053e8c1cca4a04f8824f8062f585fda197e4c7677ca73357158da88ac0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D31B231A00245EFEF31EF64ED84DAE7BB5AF41320F188AAEE4559B1A1D730D940EB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0379F3DA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3016257755-0
                                                                                                                                                                                                        • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                        • Instruction ID: 8d7997412426358510e9f2d218de284fba4523630f5be8d28615e8bc358015c9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8811803600414AFBDF12AE84EC45CEE3F72BF19355B488616FE1898030C232C5B1EB81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03793629 Relevance: 6.0, APIs: 4, Instructions: 39windowsleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000001,000001F8), ref: 03793665
                                                                                                                                                                                                        • Sleep.KERNEL32(?), ref: 0379366F
                                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000002,000001F8), ref: 0379367C
                                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 03793683
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconNotifyShell_$DestroySleepWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1659771325-0
                                                                                                                                                                                                        • Opcode ID: a236a94ec910ed8af3b0259bb2de35ff476b5843b327ece30e2bdc4e489f454c
                                                                                                                                                                                                        • Instruction ID: 10256491d01145e023b39936a8435b15e2025317fd654946cac0146bb41538ad
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a236a94ec910ed8af3b0259bb2de35ff476b5843b327ece30e2bdc4e489f454c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C501F4351043418FFB24DB64E898BBAB7E4FFC5B04F044A0DE1868B282D7759408C763
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401D22
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000), ref: 00401D29
                                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
                                                                                                                                                                                                        • CreateFontIndirectA.GDI32(004093C8), ref: 00401D8A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3272661963-0
                                                                                                                                                                                                        • Opcode ID: 100c72953127ba74b3ffacdb8c035c853e526958bf64125969925e674c33152d
                                                                                                                                                                                                        • Instruction ID: 7786b31e84b17939d49dd2ad1307eeb8220d0898c8d3ce275e00d9fc0f48c68a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 100c72953127ba74b3ffacdb8c035c853e526958bf64125969925e674c33152d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7F0C8B0959740AEE7005770AE6E7993F64A719705F245435F542FA1E3C1BC0800CF3E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03795C47 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 03795C61
                                                                                                                                                                                                          • Part of subcall function 0379795B: __FF_MSGBANNER.LIBCMT ref: 0379797E
                                                                                                                                                                                                          • Part of subcall function 0379795B: __NMSG_WRITE.LIBCMT ref: 03797985
                                                                                                                                                                                                          • Part of subcall function 0379795B: HeapAlloc.KERNEL32(00000000,03795C57,?,00000000,?,?,03795C66,?,?,?,?), ref: 037979D2
                                                                                                                                                                                                        • std::bad_alloc::bad_alloc.LIBCMT ref: 03795C84
                                                                                                                                                                                                          • Part of subcall function 03795BDD: std::exception::exception.LIBCMT ref: 03795BE9
                                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 03795C98
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 03795CA6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3622535130-0
                                                                                                                                                                                                        • Opcode ID: 5db2fac4b12b83867d971e1ab4968ef6b56245a6f9c9a2846168df6af575712a
                                                                                                                                                                                                        • Instruction ID: f31b9b5f216a873dc271641326b63c2e5b12b59d26b76813d3366a6f25771b62
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5db2fac4b12b83867d971e1ab4968ef6b56245a6f9c9a2846168df6af575712a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: ECF0E27990072A77FE06F764F819D5C3BD8AB83634B144366DC215D081EFA1C60A8682
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03797223 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 0379722F
                                                                                                                                                                                                          • Part of subcall function 03797560: __getptd_noexit.LIBCMT ref: 03797563
                                                                                                                                                                                                          • Part of subcall function 03797560: __amsg_exit.LIBCMT ref: 03797570
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 03797246
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 03797254
                                                                                                                                                                                                        • __lock.LIBCMT ref: 03797264
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3521780317-0
                                                                                                                                                                                                        • Opcode ID: e77538f17133a5ae357cc36e42d41d3b1237a794f37a0cdc3352c74e95d0c518
                                                                                                                                                                                                        • Instruction ID: 2b2c7b2cf27cd825bf7dde68b3ade19353e53c6098953b8a0223c95594da6dae
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e77538f17133a5ae357cc36e42d41d3b1237a794f37a0cdc3352c74e95d0c518
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0F06D39A20B448BFF64FB74A409B4973A0AF45A11F18834FA5449F284CB649940CB51
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 03795420 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 03794ED0: CoInitialize.OLE32(00000000), ref: 03794EF9
                                                                                                                                                                                                          • Part of subcall function 03794ED0: CoCreateInstance.OLE32(037A25C0,00000000,00000017,037A236C,?,?,00000001,?,00000000,?,00000001,?,?), ref: 03794F12
                                                                                                                                                                                                          • Part of subcall function 03794ED0: VariantInit.OLEAUT32(?), ref: 03794F21
                                                                                                                                                                                                          • Part of subcall function 03794ED0: VariantClear.OLEAUT32(?), ref: 03794F93
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03795546
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 03795573
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Variant$Clear$CreateInitInitializeInstancelstrcmpi
                                                                                                                                                                                                        • String ID: \360safe
                                                                                                                                                                                                        • API String ID: 3663946141-3015847306
                                                                                                                                                                                                        • Opcode ID: c685861f63dd4b72dea8051aa82838582f3c18e731f5cd1825c7793023dc9fed
                                                                                                                                                                                                        • Instruction ID: f460ec4481f1d32634ef164943811bd6bb89e84c79a4924d89e9c248cb29d09d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c685861f63dd4b72dea8051aa82838582f3c18e731f5cd1825c7793023dc9fed
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6E9149752083808FDB11DF69D884A1BFBE5BFCA214F184A5EF2898B361C775E845CB52
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 037988C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 03796037: __getptd.LIBCMT ref: 0379603D
                                                                                                                                                                                                          • Part of subcall function 03796037: __getptd.LIBCMT ref: 0379604D
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 037988D3
                                                                                                                                                                                                          • Part of subcall function 03797560: __getptd_noexit.LIBCMT ref: 03797563
                                                                                                                                                                                                          • Part of subcall function 03797560: __amsg_exit.LIBCMT ref: 03797570
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 037988E1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2193012126.0000000003791000.00000020.00000001.01000000.0000001C.sdmp, Offset: 03790000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2192970589.0000000003790000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193061223.00000000037A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193115520.00000000037A6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2193158164.00000000037AB000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_3790000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                        • API String ID: 803148776-1018135373
                                                                                                                                                                                                        • Opcode ID: f73113885947e346de892d8ea61c2b13e5626ffc491c09d8517882f6d22f50fc
                                                                                                                                                                                                        • Instruction ID: c7a86374753b4e22ed7a46bf80e33d161d123f71a1f6d4ce8f02373bb70dcf48
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f73113885947e346de892d8ea61c2b13e5626ffc491c09d8517882f6d22f50fc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 25014B38801308AAEF38DF68E454BADB3B9AF06261F584B6FD0855A250DB308590CB53
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004024B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000011), ref: 004024CE
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\NSISdl.dll,00000000,?,?,00000000,00000011), ref: 004024ED
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\NSISdl.dll, xrefs: 004024BC, 004024E1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileWritelstrlen
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsy5A2C.tmp\NSISdl.dll
                                                                                                                                                                                                        • API String ID: 427699356-3700297237
                                                                                                                                                                                                        • Opcode ID: ec73b0ea958737a39775a32ef629937405cc1c2eb869aa0fe21db0d8c20fe45b
                                                                                                                                                                                                        • Instruction ID: bca52da527a61a3068b9a7417769ad1d2fd465c434b27635418a89c8b40edd75
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ec73b0ea958737a39775a32ef629937405cc1c2eb869aa0fe21db0d8c20fe45b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CF0E9B2A54240BFD700EBE19E49AAB3668DB41305F20843BB142F51C2D6BD89819B3D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040557D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 00405583
                                                                                                                                                                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 00405591
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 0040557D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharPrevlstrlen
                                                                                                                                                                                                        • String ID: C:\Program Files (x86)\360\360Desktop\modules
                                                                                                                                                                                                        • API String ID: 2709904686-4274933745
                                                                                                                                                                                                        • Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                                        • Instruction ID: a78a31216ab9b60c328ce82f5fccc260d5afe3ad280ceae17d90b4b54361c34b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56D09E62509AA06EE30266549C04B9B6A49DB16710F195862E540A6195C2785D418EA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040568F Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004056AF
                                                                                                                                                                                                        • CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004056BD
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000010.00000002.2190330836.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190296304.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190369737.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190406494.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000010.00000002.2190587699.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_400000_GBInst.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                                        • Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                                        • Instruction ID: f65b762de9c196bf4895d9b9c03b18621a66a0ffa1d04d6b890c27cf309056ad
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0EF0A736249D51DBC2025B655C04E7B7E94EF92354B640D7AF444F2240D33A98159FBF
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                        Execution Coverage:7.9%
                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:49%
                                                                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                                                                        Total number of Nodes:1453
                                                                                                                                                                                                        Total number of Limit Nodes:46
                                                                                                                                                                                                        execution_graph 9690 2f22af0 9692 2f22afa 9690->9692 9691 2f22cbb 9692->9691 9714 2f22f10 9692->9714 9695 2f22b2d 9721 2f22a40 9695->9721 9705 2f22b8e 9760 2f22600 9705->9760 9711 2f22c06 9778 2f22d20 9711->9778 9713 2f22cb8 9713->9691 9715 2f22f29 9714->9715 9720 2f22b22 9714->9720 9716 2f22f39 SHGetValueA 9715->9716 9715->9720 9717 2f22f88 9716->9717 9716->9720 9718 2f22d20 61 API calls 9717->9718 9717->9720 9719 2f2302e lstrcmpiA 9718->9719 9719->9720 9720->9691 9720->9695 9722 2f22aaf 9721->9722 9723 2f22ad4 9722->9723 9792 2f22100 9722->9792 9725 2f21f40 9723->9725 9726 2f220dc 9725->9726 9733 2f21f56 9725->9733 9726->9705 9734 2f22170 9726->9734 9727 2f22100 48 API calls 9728 2f21f80 CreateFileA 9727->9728 9729 2f21fa8 DeviceIoControl 9728->9729 9728->9733 9730 2f21fde CloseHandle 9729->9730 9729->9733 9730->9733 9731 2f220bc CloseHandle 9731->9726 9731->9733 9733->9726 9733->9727 9733->9731 10104 2f21380 DeviceIoControl 9733->10104 9735 2f22184 9734->9735 9736 2f22100 48 API calls 9735->9736 9738 2f222ef 9735->9738 9739 2f22208 DeviceIoControl 9735->9739 9740 2f222d6 CloseHandle 9735->9740 9737 2f2219c CreateFileA 9736->9737 9737->9735 9738->9705 9741 2f22300 9738->9741 9739->9735 9740->9735 9748 2f2230a 9741->9748 9742 2f22100 48 API calls 9743 2f2234d CreateFileA 9742->9743 9744 2f2236e DeviceIoControl 9743->9744 9743->9748 9746 2f22435 CloseHandle 9744->9746 9744->9748 9745 2f2245b 9745->9705 9749 2f22480 9745->9749 9746->9745 9746->9748 9748->9742 9748->9745 9748->9746 10105 2f21200 9748->10105 9758 2f22496 9749->9758 9750 2f22100 48 API calls 9751 2f224ab CreateFileA 9750->9751 9752 2f224d3 DeviceIoControl 9751->9752 9751->9758 9752->9758 9753 2f225f2 9753->9705 9754 2f23ea7 29 API calls 9755 2f22519 DeviceIoControl 9754->9755 9756 2f225cc CloseHandle 9755->9756 9759 2f2254a 9755->9759 9757 2f23dbe 29 API calls 9756->9757 9757->9758 9758->9750 9758->9753 9758->9754 9759->9756 9761 2f22614 9760->9761 9765 2f22772 9760->9765 9762 2f22623 RegOpenKeyExA 9761->9762 9761->9765 9762->9765 9767 2f22651 9762->9767 9763 2f22662 RegEnumKeyExA 9764 2f22693 RegOpenKeyExA 9763->9764 9763->9765 9766 2f226b6 RegQueryValueExA 9764->9766 9764->9767 9765->9711 9770 2f22910 Netbios 9765->9770 9766->9767 9767->9763 9769 2f2271a lstrcmpA 9767->9769 10176 2f22800 9767->10176 9769->9767 9771 2f22a35 9770->9771 9772 2f2294a Netbios 9770->9772 9771->9711 9773 2f229a0 Netbios 9772->9773 9773->9771 9775 2f229d6 9773->9775 9776 2f22100 48 API calls 9775->9776 9777 2f22a21 9776->9777 9777->9711 9779 2f22d55 9778->9779 9780 2f22100 48 API calls 9779->9780 9782 2f22d77 9780->9782 9781 2f22100 48 API calls 9781->9782 9782->9781 9783 2f22e8d 9782->9783 9784 2f22caa 9783->9784 9785 2f22100 48 API calls 9783->9785 9784->9691 9788 2f230e0 9784->9788 9786 2f22ec5 9785->9786 10185 2f241b4 9786->10185 9789 2f22d20 61 API calls 9788->9789 9791 2f2310c SHSetValueA 9789->9791 9791->9713 9793 2f22111 9792->9793 9794 2f2210b 9792->9794 9795 2f2211a 9793->9795 9798 2f23c6f 9793->9798 9794->9723 9795->9723 9803 2f25833 9798->9803 9801 2f2213d 9801->9723 9804 2f23c9b 9803->9804 9809 2f2585b __aulldiv __aullrem 9803->9809 9804->9801 9812 2f24b10 9804->9812 9805 2f25fd1 44 API calls 9805->9809 9808 2f26006 44 API calls 9808->9809 9809->9804 9809->9805 9809->9808 9810 2f28e98 39 API calls 9809->9810 9811 2f26037 44 API calls 9809->9811 9824 2f23ea7 9809->9824 9827 2f23dbe 9809->9827 9810->9809 9811->9809 9813 2f24baa 9812->9813 9814 2f24b26 9812->9814 9813->9801 9814->9813 9822 2f24b81 9814->9822 9971 2f2863d 9814->9971 9815 2f24bf2 9817 2f2844d 44 API calls 9815->9817 9816 2f24b8b 9818 2f24ba2 9816->9818 9821 2f24bb2 9816->9821 9817->9813 9974 2f2844d 9818->9974 9821->9813 9988 2f28375 9821->9988 9822->9815 9822->9816 9844 2f23eb9 9824->9844 9828 2f23e98 9827->9828 9829 2f23dec 9827->9829 9828->9809 9830 2f23df6 9829->9830 9831 2f23e31 9829->9831 9832 2f2556e 28 API calls 9830->9832 9834 2f2556e 28 API calls 9831->9834 9842 2f23e22 9831->9842 9835 2f23dfd 9832->9835 9833 2f23e8a HeapFree 9833->9828 9840 2f23e3d 9834->9840 9836 2f23e17 9835->9836 9944 2f2636a 9835->9944 9950 2f23e28 9836->9950 9839 2f23e69 9957 2f23e80 9839->9957 9840->9839 9953 2f270f1 9840->9953 9842->9828 9842->9833 9845 2f23eb6 9844->9845 9847 2f23ec0 9844->9847 9845->9809 9847->9845 9848 2f23ee5 9847->9848 9849 2f23f12 9848->9849 9853 2f23f55 9848->9853 9857 2f23f40 9849->9857 9866 2f2556e 9849->9866 9851 2f23f28 9881 2f26693 9851->9881 9852 2f23fc4 RtlAllocateHeap 9855 2f23f47 9852->9855 9856 2f23f77 9853->9856 9853->9857 9855->9847 9859 2f2556e 28 API calls 9856->9859 9857->9852 9857->9855 9861 2f23f7e 9859->9861 9890 2f27136 9861->9890 9863 2f23f91 9897 2f23fab 9863->9897 9867 2f25586 9866->9867 9868 2f255c4 EnterCriticalSection 9866->9868 9869 2f23ea7 27 API calls 9867->9869 9868->9851 9870 2f2558e 9869->9870 9873 2f2559c 9870->9873 9900 2f245a2 9870->9900 9871 2f2556e 27 API calls 9874 2f255a4 9871->9874 9873->9871 9875 2f255b5 9874->9875 9876 2f255ab InitializeCriticalSection 9874->9876 9878 2f23dbe 27 API calls 9875->9878 9877 2f255ba 9876->9877 9906 2f255cf LeaveCriticalSection 9877->9906 9878->9877 9880 2f255c2 9880->9868 9885 2f266c5 9881->9885 9882 2f26764 9884 2f23f33 9882->9884 9929 2f26a4d 9882->9929 9887 2f23f4c 9884->9887 9885->9882 9885->9884 9922 2f2699c 9885->9922 9933 2f255cf LeaveCriticalSection 9887->9933 9889 2f23f53 9889->9857 9895 2f27144 9890->9895 9891 2f27230 VirtualAlloc 9896 2f27201 9891->9896 9892 2f27305 9934 2f26e3e 9892->9934 9895->9891 9895->9892 9895->9896 9896->9863 9943 2f255cf LeaveCriticalSection 9897->9943 9899 2f23f9e 9899->9855 9899->9857 9901 2f245ac 9900->9901 9902 2f245be 9901->9902 9907 2f27ea8 9901->9907 9913 2f27ee1 9902->9913 9906->9880 9908 2f27eb2 9907->9908 9909 2f27edf 9908->9909 9910 2f27ee1 7 API calls 9908->9910 9909->9902 9911 2f27ec9 9910->9911 9912 2f27ee1 7 API calls 9911->9912 9912->9909 9914 2f27ef4 9913->9914 9915 2f2800b 9914->9915 9916 2f27f34 9914->9916 9921 2f245c7 9914->9921 9918 2f2801e GetStdHandle WriteFile 9915->9918 9917 2f27f40 GetModuleFileNameA 9916->9917 9916->9921 9919 2f27f58 9917->9919 9918->9921 9920 2f29bc9 LoadLibraryA GetProcAddress GetProcAddress GetProcAddress 9919->9920 9920->9921 9921->9873 9923 2f269df HeapAlloc 9922->9923 9924 2f269af HeapReAlloc 9922->9924 9926 2f26a2f 9923->9926 9927 2f26a05 VirtualAlloc 9923->9927 9925 2f269ce 9924->9925 9924->9926 9925->9923 9926->9882 9927->9926 9928 2f26a1f HeapFree 9927->9928 9928->9926 9930 2f26a5f VirtualAlloc 9929->9930 9932 2f26aa8 9930->9932 9932->9884 9933->9889 9935 2f26e52 HeapAlloc 9934->9935 9936 2f26e4b 9934->9936 9937 2f26e6f VirtualAlloc 9935->9937 9942 2f26ea7 9935->9942 9936->9937 9938 2f26f64 9937->9938 9939 2f26e8f VirtualAlloc 9937->9939 9940 2f26f6c HeapFree 9938->9940 9938->9942 9941 2f26f56 VirtualFree 9939->9941 9939->9942 9940->9942 9941->9938 9942->9896 9943->9899 9945 2f263a8 9944->9945 9949 2f2665e 9944->9949 9946 2f265a4 VirtualFree 9945->9946 9945->9949 9947 2f26608 9946->9947 9948 2f26617 VirtualFree HeapFree 9947->9948 9947->9949 9948->9949 9949->9836 9960 2f255cf LeaveCriticalSection 9950->9960 9952 2f23e2f 9952->9842 9954 2f27134 9953->9954 9955 2f2711e 9953->9955 9954->9839 9955->9954 9961 2f26fd8 9955->9961 9970 2f255cf LeaveCriticalSection 9957->9970 9959 2f23e87 9959->9842 9960->9952 9964 2f26fe5 9961->9964 9962 2f27095 9962->9954 9963 2f27006 VirtualFree 9963->9964 9964->9962 9964->9963 9966 2f26f82 VirtualFree 9964->9966 9967 2f26f9f 9966->9967 9968 2f26fcf 9967->9968 9969 2f26faf HeapFree 9967->9969 9968->9964 9969->9964 9970->9959 9972 2f23ea7 29 API calls 9971->9972 9973 2f2864d 9972->9973 9973->9822 9975 2f2849a 9974->9975 9976 2f2845a 9974->9976 10034 2f29cc5 9975->10034 9976->9975 9977 2f28475 9976->9977 10002 2f29d98 9977->10002 9981 2f2847c 10011 2f284b2 9981->10011 9987 2f28492 9987->9813 9989 2f283c2 9988->9989 9990 2f28382 9988->9990 9991 2f29cc5 35 API calls 9989->9991 9990->9989 9992 2f2839d 9990->9992 9993 2f283c7 9991->9993 9994 2f29d98 31 API calls 9992->9994 9995 2f29cce 35 API calls 9993->9995 9996 2f283a4 9994->9996 9997 2f283d2 9995->9997 9998 2f283da 37 API calls 9996->9998 9997->9813 9999 2f283b2 9998->9999 10103 2f29df7 LeaveCriticalSection 9999->10103 10001 2f283ba 10001->9813 10003 2f29dc3 10002->10003 10004 2f29de6 EnterCriticalSection 10002->10004 10005 2f2556e 29 API calls 10003->10005 10004->9981 10006 2f29dca 10005->10006 10007 2f29dd1 InitializeCriticalSection 10006->10007 10008 2f29dde 10006->10008 10007->10008 10040 2f255cf LeaveCriticalSection 10008->10040 10010 2f29de5 10010->10004 10012 2f284d2 10011->10012 10029 2f2848a 10011->10029 10013 2f284ff 10012->10013 10041 2f283da 10012->10041 10015 2f285d1 WriteFile 10013->10015 10020 2f28510 10013->10020 10017 2f285f3 GetLastError 10015->10017 10018 2f28598 10015->10018 10016 2f2860c 10019 2f29cc5 35 API calls 10016->10019 10016->10029 10017->10018 10018->10016 10022 2f285aa 10018->10022 10018->10029 10023 2f28626 10019->10023 10020->10016 10020->10018 10021 2f2855c WriteFile 10020->10021 10021->10020 10024 2f285c6 GetLastError 10021->10024 10025 2f285b2 10022->10025 10026 2f285fe 10022->10026 10027 2f29cce 35 API calls 10023->10027 10024->10018 10028 2f29cc5 35 API calls 10025->10028 10051 2f29c52 10026->10051 10027->10029 10031 2f285b7 10028->10031 10033 2f29df7 LeaveCriticalSection 10029->10033 10032 2f29cce 35 API calls 10031->10032 10032->10029 10033->9987 10075 2f27601 GetLastError TlsGetValue 10034->10075 10036 2f2849f 10037 2f29cce 10036->10037 10038 2f27601 35 API calls 10037->10038 10039 2f284aa 10038->10039 10039->9813 10040->10010 10068 2f29d56 10041->10068 10043 2f283e6 10044 2f283f9 SetFilePointer 10043->10044 10045 2f283ec 10043->10045 10047 2f28411 GetLastError 10044->10047 10048 2f28419 10044->10048 10046 2f29cc5 35 API calls 10045->10046 10049 2f283f1 10046->10049 10047->10048 10048->10049 10050 2f29c52 35 API calls 10048->10050 10049->10013 10050->10049 10052 2f29cce 35 API calls 10051->10052 10053 2f29c58 10052->10053 10054 2f29c8b 10053->10054 10056 2f29c74 10053->10056 10055 2f29cc5 35 API calls 10054->10055 10057 2f29c90 10055->10057 10058 2f29c9b 10056->10058 10060 2f29c7e 10056->10060 10057->10029 10059 2f29cb8 10058->10059 10062 2f29cab 10058->10062 10063 2f29cc5 35 API calls 10059->10063 10061 2f29cc5 35 API calls 10060->10061 10064 2f29c83 10061->10064 10065 2f29cc5 35 API calls 10062->10065 10066 2f29cbd 10063->10066 10064->10029 10067 2f29cb0 10065->10067 10066->10029 10067->10029 10069 2f29d62 10068->10069 10070 2f29d7e 10069->10070 10071 2f29cc5 35 API calls 10069->10071 10070->10043 10072 2f29d86 10071->10072 10073 2f29cce 35 API calls 10072->10073 10074 2f29d91 10073->10074 10074->10043 10076 2f2765c SetLastError 10075->10076 10077 2f2761d 10075->10077 10076->10036 10086 2f29681 10077->10086 10080 2f27654 10083 2f245a2 7 API calls 10080->10083 10081 2f2762e TlsSetValue 10081->10080 10082 2f2763f 10081->10082 10085 2f27645 GetCurrentThreadId 10082->10085 10084 2f2765b 10083->10084 10084->10076 10085->10076 10093 2f296b6 10086->10093 10087 2f27626 10087->10080 10087->10081 10088 2f2976e HeapAlloc 10088->10093 10089 2f2556e 29 API calls 10089->10093 10090 2f26693 5 API calls 10090->10093 10091 2f27136 6 API calls 10091->10093 10093->10087 10093->10088 10093->10089 10093->10090 10093->10091 10095 2f2971a 10093->10095 10098 2f297a3 10093->10098 10101 2f255cf LeaveCriticalSection 10095->10101 10097 2f29721 10097->10093 10102 2f255cf LeaveCriticalSection 10098->10102 10100 2f297aa 10100->10093 10101->10097 10102->10100 10103->10001 10104->9733 10106 2f21210 10105->10106 10110 2f21214 10105->10110 10106->9748 10107 2f212dd 10107->9748 10110->10107 10113 2f212b9 10110->10113 10114 2f23b35 10110->10114 10125 2f23adf 10110->10125 10130 2f23b07 10110->10130 10111 2f23b07 6 API calls 10111->10113 10113->10107 10113->10111 10115 2f23b53 InterlockedIncrement 10114->10115 10118 2f23b40 10114->10118 10116 2f23b6f InterlockedDecrement 10115->10116 10117 2f23b79 10115->10117 10119 2f2556e 29 API calls 10116->10119 10135 2f23ba4 10117->10135 10118->10110 10119->10117 10122 2f23b99 InterlockedDecrement 10122->10118 10123 2f23b8f 10141 2f255cf LeaveCriticalSection 10123->10141 10126 2f23af6 10125->10126 10127 2f23ae8 10125->10127 10126->10110 10128 2f25464 6 API calls 10127->10128 10129 2f23af3 10128->10129 10129->10110 10131 2f23b10 10130->10131 10132 2f23b21 10130->10132 10133 2f25464 6 API calls 10131->10133 10132->10110 10134 2f23b1e 10133->10134 10134->10110 10136 2f23bd1 10135->10136 10140 2f23b86 10135->10140 10137 2f23bef 10136->10137 10142 2f25464 10136->10142 10137->10140 10146 2f255e4 10137->10146 10140->10122 10140->10123 10141->10118 10143 2f25482 10142->10143 10145 2f25476 10142->10145 10164 2f28b9e 10143->10164 10145->10137 10147 2f25614 LCMapStringW 10146->10147 10148 2f25630 10146->10148 10147->10148 10149 2f25638 LCMapStringA 10147->10149 10150 2f25696 10148->10150 10151 2f25679 LCMapStringA 10148->10151 10149->10148 10152 2f25772 10149->10152 10150->10152 10153 2f256ac MultiByteToWideChar 10150->10153 10151->10152 10152->10140 10153->10152 10154 2f256d6 10153->10154 10154->10152 10155 2f2570c MultiByteToWideChar 10154->10155 10155->10152 10156 2f25725 LCMapStringW 10155->10156 10156->10152 10157 2f25740 10156->10157 10158 2f25746 10157->10158 10160 2f25786 10157->10160 10158->10152 10159 2f25754 LCMapStringW 10158->10159 10159->10152 10160->10152 10161 2f257be LCMapStringW 10160->10161 10161->10152 10162 2f257d6 WideCharToMultiByte 10161->10162 10162->10152 10165 2f28bcf GetStringTypeW 10164->10165 10166 2f28be7 10164->10166 10165->10166 10169 2f28beb GetStringTypeA 10165->10169 10167 2f28c12 GetStringTypeA 10166->10167 10168 2f28c36 10166->10168 10170 2f28cd3 10167->10170 10168->10170 10172 2f28c4c MultiByteToWideChar 10168->10172 10169->10166 10169->10170 10170->10145 10172->10170 10173 2f28c70 10172->10173 10173->10170 10174 2f28caa MultiByteToWideChar 10173->10174 10174->10170 10175 2f28cc3 GetStringTypeW 10174->10175 10175->10170 10177 2f22100 48 API calls 10176->10177 10178 2f22824 CreateFileA 10177->10178 10179 2f22855 DeviceIoControl 10178->10179 10180 2f2284a 10178->10180 10181 2f228f0 CloseHandle 10179->10181 10182 2f22888 10179->10182 10180->9767 10181->9767 10182->10181 10183 2f22100 48 API calls 10182->10183 10184 2f228e8 10183->10184 10184->10181 10186 2f241f2 InterlockedIncrement 10185->10186 10199 2f241c8 10185->10199 10187 2f24206 InterlockedDecrement 10186->10187 10188 2f24214 10186->10188 10189 2f2556e 29 API calls 10187->10189 10190 2f24267 10188->10190 10191 2f2422a 10188->10191 10189->10188 10192 2f255e4 9 API calls 10190->10192 10193 2f24239 InterlockedDecrement 10191->10193 10194 2f2422f 10191->10194 10195 2f2427e 10192->10195 10193->10199 10207 2f255cf LeaveCriticalSection 10194->10207 10197 2f242ac 10195->10197 10198 2f23ea7 29 API calls 10195->10198 10200 2f242d1 InterlockedDecrement 10197->10200 10201 2f242c7 10197->10201 10203 2f2428d 10198->10203 10199->9784 10202 2f242ce 10200->10202 10208 2f255cf LeaveCriticalSection 10201->10208 10205 2f23dbe 29 API calls 10202->10205 10203->10197 10206 2f255e4 9 API calls 10203->10206 10205->10199 10206->10197 10207->10199 10208->10202 10678 401f51 10679 401f63 10678->10679 10680 402004 10678->10680 10681 4029e8 18 API calls 10679->10681 10682 401423 25 API calls 10680->10682 10683 401f6a 10681->10683 10688 40215b 10682->10688 10684 4029e8 18 API calls 10683->10684 10685 401f73 10684->10685 10686 401f88 LoadLibraryExA 10685->10686 10687 401f7b GetModuleHandleA 10685->10687 10686->10680 10689 401f98 GetProcAddress 10686->10689 10687->10686 10687->10689 10690 401fe5 10689->10690 10691 401fa8 10689->10691 10692 404de1 25 API calls 10690->10692 10693 401fb0 10691->10693 10694 401fc7 10691->10694 10695 401fb8 10692->10695 10755 401423 10693->10755 10701 10004398 10694->10701 10726 100042b0 10694->10726 10744 100048b1 10694->10744 10695->10688 10697 401ff8 FreeLibrary 10695->10697 10697->10688 10758 10002cf0 10701->10758 10705 100043d7 10706 10002b98 2 API calls 10705->10706 10707 100043e2 10706->10707 10708 10002b98 2 API calls 10707->10708 10709 100043e9 10708->10709 10710 10002b98 2 API calls 10709->10710 10711 100043f5 10710->10711 10712 1000458f 10711->10712 10768 10003393 10711->10768 10800 10002c7b 10712->10800 10715 1000459a 10715->10695 10716 10004551 10718 1000358f 11 API calls 10716->10718 10717 10004440 10717->10712 10717->10716 10721 1000448b 10717->10721 10719 100044fa 10718->10719 10720 1000457c RegCloseKey 10719->10720 10720->10712 10722 1000449a 10721->10722 10723 100044d1 10721->10723 10783 1000358f 10722->10783 10723->10720 10725 1000358f 11 API calls 10723->10725 10725->10719 10727 10002cf0 GetWindowsDirectoryW 10726->10727 10728 100042ca 10727->10728 10729 10002b98 2 API calls 10728->10729 10730 100042f4 10729->10730 10731 10002b98 2 API calls 10730->10731 10732 10004300 10731->10732 10826 100038ad 10732->10826 10736 1000433b RegCloseKey 10738 1000434f 10736->10738 10741 10004369 10736->10741 10737 10002c7b 3 API calls 10739 1000437c 10737->10739 10848 100027c0 10738->10848 10742 10002c7b 3 API calls 10739->10742 10741->10737 10743 10004395 10742->10743 10743->10695 10745 10002cf0 GetWindowsDirectoryW 10744->10745 10746 100048ca 10745->10746 10747 10002b98 2 API calls 10746->10747 10748 100048e2 10747->10748 10749 10003393 7 API calls 10748->10749 10750 10004913 10749->10750 10751 1000491c RegCloseKey 10750->10751 10752 10004930 10750->10752 10751->10752 10753 10002c7b 3 API calls 10752->10753 10754 10004942 10753->10754 10754->10695 10756 404de1 25 API calls 10755->10756 10757 401431 10756->10757 10757->10695 10759 10002d1e 10758->10759 10761 10002d4b 10758->10761 10805 10002290 10759->10805 10762 10002b98 10761->10762 10763 10002c03 10762->10763 10764 10002ba4 10762->10764 10763->10705 10764->10763 10765 10002bb6 10764->10765 10766 10002bcb MultiByteToWideChar 10764->10766 10767 10002bed GlobalFree 10765->10767 10766->10765 10767->10705 10769 100033a0 10768->10769 10770 100033ed 10768->10770 10808 10002f8e 10769->10808 10771 100033f1 RegCreateKeyExW 10770->10771 10772 10003414 10770->10772 10771->10717 10814 100022b7 10772->10814 10777 10002f8e 3 API calls 10778 100033b5 RegCreateKeyExA 10777->10778 10811 10002335 10778->10811 10781 10002335 GlobalFree 10782 100033e4 10781->10782 10782->10717 10784 100035a5 10783->10784 10785 1000362e 10783->10785 10788 10002f8e 3 API calls 10784->10788 10786 10003632 RegSetValueExW 10785->10786 10787 1000364c 10785->10787 10790 10003627 10786->10790 10791 100022b7 MessageBoxW 10787->10791 10789 100035ae 10788->10789 10792 100035df GlobalAlloc 10789->10792 10795 100035c6 RegSetValueExA 10789->10795 10790->10719 10791->10790 10793 100035f2 10792->10793 10794 1000361e 10792->10794 10823 10002347 10793->10823 10797 1000361f 10794->10797 10795->10797 10799 10002335 GlobalFree 10797->10799 10799->10790 10801 10002c86 10800->10801 10802 10002cb0 10800->10802 10803 10002cb5 GlobalAlloc WideCharToMultiByte 10801->10803 10804 10002c8f GlobalAlloc 10801->10804 10802->10715 10803->10802 10804->10802 10806 100022b6 10805->10806 10807 1000229a GetWindowsDirectoryW 10805->10807 10806->10761 10807->10806 10817 100022dc 10808->10817 10812 10002346 10811->10812 10813 1000233c GlobalFree 10811->10813 10812->10781 10813->10812 10815 100022c0 MessageBoxW 10814->10815 10816 100022db 10814->10816 10815->10816 10816->10717 10818 100022e8 WideCharToMultiByte 10817->10818 10819 1000232e 10817->10819 10818->10819 10820 10002304 GlobalAlloc 10818->10820 10819->10777 10820->10819 10821 10002312 WideCharToMultiByte 10820->10821 10822 10002326 10821->10822 10822->10819 10824 10002354 WideCharToMultiByte 10823->10824 10825 10002370 RegSetValueExA GlobalFree 10823->10825 10824->10825 10825->10794 10852 1000341e 10826->10852 10828 100038cf 10828->10741 10829 1000347f 10828->10829 10830 10003493 10829->10830 10831 10003567 10829->10831 10832 10002f8e 3 API calls 10830->10832 10833 10003585 10831->10833 10834 1000356b RegQueryValueExW 10831->10834 10835 1000349c RegQueryValueExA 10832->10835 10836 100022b7 MessageBoxW 10833->10836 10834->10736 10837 100034c4 10835->10837 10845 1000353f 10835->10845 10838 1000358a 10836->10838 10840 100034ef 10837->10840 10843 100034d6 RegQueryValueExA 10837->10843 10838->10736 10839 10002335 GlobalFree 10841 10003560 10839->10841 10842 100034f9 GlobalAlloc 10840->10842 10840->10845 10841->10736 10844 1000350b RegQueryValueExA 10842->10844 10842->10845 10843->10845 10863 1000237c 10844->10863 10845->10839 10849 100027d9 10848->10849 10850 10002825 10848->10850 10849->10850 10866 10001eaf 10849->10866 10850->10741 10853 1000345a 10852->10853 10854 1000342b 10852->10854 10855 10003475 10853->10855 10856 1000345e RegOpenKeyExW 10853->10856 10857 10002f8e 3 API calls 10854->10857 10858 100022b7 MessageBoxW 10855->10858 10856->10828 10859 10003435 RegOpenKeyExA 10857->10859 10860 1000347a 10858->10860 10861 10002335 GlobalFree 10859->10861 10860->10828 10862 10003453 10861->10862 10862->10828 10864 10002386 MultiByteToWideChar 10863->10864 10865 100023a0 GlobalFree 10863->10865 10864->10865 10865->10845 10867 10002276 10866->10867 10868 10001ed3 10866->10868 10867->10850 10868->10867 10869 100020ee lstrlenA 10868->10869 10870 1000210b lstrlenW 10868->10870 10871 1000214d MultiByteToWideChar 10868->10871 10869->10868 10870->10868 10871->10868 10650 40266e 10651 4029e8 18 API calls 10650->10651 10653 40267c 10651->10653 10652 402692 10655 4056fb 2 API calls 10652->10655 10653->10652 10654 4029e8 18 API calls 10653->10654 10654->10652 10656 402698 10655->10656 10676 40571a GetFileAttributesA CreateFileA 10656->10676 10658 4026a5 10659 4026b1 GlobalAlloc 10658->10659 10660 40274e 10658->10660 10663 402745 FindCloseChangeNotification 10659->10663 10664 4026ca 10659->10664 10661 402756 DeleteFileA 10660->10661 10662 402769 10660->10662 10661->10662 10663->10660 10677 4031da SetFilePointer 10664->10677 10666 4026d0 10667 4031a8 ReadFile 10666->10667 10668 4026d9 GlobalAlloc 10667->10668 10669 4026e9 10668->10669 10670 40271d WriteFile GlobalFree 10668->10670 10671 402f01 47 API calls 10669->10671 10672 402f01 47 API calls 10670->10672 10675 4026f6 10671->10675 10673 402742 10672->10673 10673->10663 10674 402714 GlobalFree 10674->10670 10675->10674 10676->10658 10677->10666 11559 40276f 11560 4029cb 18 API calls 11559->11560 11561 402775 11560->11561 11562 4027b0 11561->11562 11563 402799 11561->11563 11568 40264e 11561->11568 11564 4027c6 11562->11564 11565 4027ba 11562->11565 11566 4027ad 11563->11566 11567 40279e 11563->11567 11570 405a65 18 API calls 11564->11570 11569 4029cb 18 API calls 11565->11569 11566->11568 11574 4059a1 wsprintfA 11566->11574 11573 405a43 lstrcpynA 11567->11573 11569->11566 11570->11566 11573->11568 11574->11568 11575 2f210c0 11576 2f210c9 11575->11576 11577 2f210fc 11575->11577 11576->11577 11580 2f22af0 11576->11580 11582 2f22afa 11580->11582 11581 2f210ee 11582->11581 11583 2f22f10 63 API calls 11582->11583 11584 2f22b22 11583->11584 11584->11581 11585 2f22b2d 11584->11585 11586 2f22a40 48 API calls 11585->11586 11587 2f22b48 11586->11587 11588 2f21f40 53 API calls 11587->11588 11589 2f22b54 11588->11589 11590 2f22170 51 API calls 11589->11590 11595 2f22b8e 11589->11595 11591 2f22b68 11590->11591 11592 2f22300 69 API calls 11591->11592 11591->11595 11593 2f22b7b 11592->11593 11593->11595 11597 2f22480 52 API calls 11593->11597 11594 2f22600 56 API calls 11596 2f22bf3 11594->11596 11595->11594 11598 2f22910 51 API calls 11596->11598 11601 2f22c06 11596->11601 11597->11595 11598->11601 11599 2f22d20 61 API calls 11600 2f22caa 11599->11600 11600->11581 11602 2f230e0 62 API calls 11600->11602 11601->11599 11603 2f22cb8 11602->11603 11603->11581 10563 401b06 10564 401b13 10563->10564 10565 401b57 10563->10565 10566 401b9b 10564->10566 10573 401b2a 10564->10573 10567 401b80 GlobalAlloc 10565->10567 10568 401b5b 10565->10568 10570 405a65 18 API calls 10566->10570 10581 402200 10566->10581 10569 405a65 18 API calls 10567->10569 10568->10581 10584 405a43 lstrcpynA 10568->10584 10569->10566 10572 4021fa 10570->10572 10576 405304 MessageBoxIndirectA 10572->10576 10572->10581 10582 405a43 lstrcpynA 10573->10582 10574 401b6d GlobalFree 10574->10581 10576->10581 10577 401b39 10583 405a43 lstrcpynA 10577->10583 10579 401b48 10585 405a43 lstrcpynA 10579->10585 10582->10577 10583->10579 10584->10574 10585->10581 10640 2f23eb9 10641 2f23ee2 10640->10641 10643 2f23ec0 10640->10643 10642 2f23ee5 29 API calls 10642->10643 10643->10641 10643->10642 9619 401721 9625 4029e8 9619->9625 9623 40172f 9624 405749 2 API calls 9623->9624 9624->9623 9626 4029f4 9625->9626 9635 405a65 9626->9635 9629 401728 9631 405749 9629->9631 9632 405754 GetTickCount GetTempFileNameA 9631->9632 9633 405780 9632->9633 9634 405784 9632->9634 9633->9632 9633->9634 9634->9623 9636 405a72 9635->9636 9637 405c88 9636->9637 9640 405b06 GetVersion 9636->9640 9641 405c5f lstrlenA 9636->9641 9642 405a65 10 API calls 9636->9642 9645 405b7e GetSystemDirectoryA 9636->9645 9647 405b91 GetWindowsDirectoryA 9636->9647 9648 405ca1 5 API calls 9636->9648 9649 405a65 10 API calls 9636->9649 9650 405c08 lstrcatA 9636->9650 9651 405bc5 SHGetSpecialFolderLocation 9636->9651 9662 40592a RegOpenKeyExA 9636->9662 9667 4059a1 wsprintfA 9636->9667 9668 405a43 lstrcpynA 9636->9668 9638 402a15 9637->9638 9669 405a43 lstrcpynA 9637->9669 9638->9629 9653 405ca1 9638->9653 9640->9636 9641->9636 9642->9641 9645->9636 9647->9636 9648->9636 9649->9636 9650->9636 9651->9636 9652 405bdd SHGetPathFromIDListA CoTaskMemFree 9651->9652 9652->9636 9660 405cad 9653->9660 9654 405d15 9655 405d19 CharPrevA 9654->9655 9657 405d34 9654->9657 9655->9654 9656 405d0a CharNextA 9656->9654 9656->9660 9657->9629 9659 405cf8 CharNextA 9659->9660 9660->9654 9660->9656 9660->9659 9661 405d05 CharNextA 9660->9661 9670 405561 9660->9670 9661->9656 9663 40599b 9662->9663 9664 40595d RegQueryValueExA 9662->9664 9663->9636 9665 40597e RegCloseKey 9664->9665 9665->9663 9667->9636 9668->9636 9669->9638 9671 405567 9670->9671 9672 40557a 9671->9672 9673 40556d CharNextA 9671->9673 9672->9660 9673->9671 10209 403225 #17 SetErrorMode OleInitialize 10279 405d61 GetModuleHandleA 10209->10279 10213 403293 GetCommandLineA 10284 405a43 lstrcpynA 10213->10284 10215 4032a5 GetModuleHandleA 10216 4032bc 10215->10216 10217 405561 CharNextA 10216->10217 10218 4032d0 CharNextA 10217->10218 10228 4032dd 10218->10228 10219 403346 10220 403359 GetTempPathA 10219->10220 10285 4031f1 10220->10285 10222 40336f 10223 403393 DeleteFileA 10222->10223 10224 403373 GetWindowsDirectoryA lstrcatA 10222->10224 10293 402c5b GetTickCount GetModuleFileNameA 10223->10293 10226 4031f1 11 API calls 10224->10226 10225 405561 CharNextA 10225->10228 10229 40338f 10226->10229 10228->10219 10228->10225 10230 403348 10228->10230 10229->10223 10233 403411 ExitProcess OleUninitialize 10229->10233 10378 405a43 lstrcpynA 10230->10378 10231 4033a4 10231->10233 10236 4033fd 10231->10236 10240 405561 CharNextA 10231->10240 10234 403426 10233->10234 10235 40350b 10233->10235 10395 405304 10234->10395 10238 40358e ExitProcess 10235->10238 10244 405d61 3 API calls 10235->10244 10323 4035e3 10236->10323 10242 4033bb 10240->10242 10249 4033d8 10242->10249 10250 40343c lstrcatA lstrcmpiA 10242->10250 10246 40351a 10244->10246 10247 405d61 3 API calls 10246->10247 10248 403523 10247->10248 10251 405d61 3 API calls 10248->10251 10379 405617 10249->10379 10250->10233 10252 403458 CreateDirectoryA SetCurrentDirectoryA 10250->10252 10254 40352c 10251->10254 10255 40347a 10252->10255 10256 40346f 10252->10256 10258 40357a ExitWindowsEx 10254->10258 10263 40353a GetCurrentProcess 10254->10263 10400 405a43 lstrcpynA 10255->10400 10399 405a43 lstrcpynA 10256->10399 10258->10238 10262 403587 10258->10262 10433 40140b 10262->10433 10268 40354a 10263->10268 10264 4033f2 10394 405a43 lstrcpynA 10264->10394 10267 405a65 18 API calls 10269 4034aa DeleteFileA 10267->10269 10268->10258 10270 4034b7 CopyFileA 10269->10270 10276 403488 10269->10276 10270->10276 10271 4034ff 10273 405791 39 API calls 10271->10273 10274 403506 10273->10274 10274->10233 10275 405a65 18 API calls 10275->10276 10276->10267 10276->10271 10276->10275 10278 4034eb CloseHandle 10276->10278 10401 405791 10276->10401 10430 4052a3 CreateProcessA 10276->10430 10278->10276 10280 405d88 GetProcAddress 10279->10280 10281 405d7d LoadLibraryA 10279->10281 10282 403268 SHGetFileInfoA 10280->10282 10281->10280 10281->10282 10283 405a43 lstrcpynA 10282->10283 10283->10213 10284->10215 10286 405ca1 5 API calls 10285->10286 10288 4031fd 10286->10288 10287 403207 10287->10222 10288->10287 10436 405536 lstrlenA CharPrevA 10288->10436 10291 405749 2 API calls 10292 403223 10291->10292 10292->10222 10439 40571a GetFileAttributesA CreateFileA 10293->10439 10295 402c9e 10322 402cab 10295->10322 10440 405a43 lstrcpynA 10295->10440 10297 402cc1 10441 40557d lstrlenA 10297->10441 10301 402cd2 GetFileSize 10302 402dd3 10301->10302 10321 402ce9 10301->10321 10448 402bc5 10302->10448 10306 402e6e 10309 402bc5 32 API calls 10306->10309 10307 402e16 GlobalAlloc 10308 402e2d 10307->10308 10314 405749 2 API calls 10308->10314 10309->10322 10311 402df7 10312 4031a8 ReadFile 10311->10312 10315 402e02 10312->10315 10313 402bc5 32 API calls 10313->10321 10316 402e3e CreateFileA 10314->10316 10315->10307 10315->10322 10317 402e78 10316->10317 10316->10322 10463 4031da SetFilePointer 10317->10463 10319 402e86 10464 402f01 10319->10464 10321->10302 10321->10306 10321->10313 10321->10322 10446 4031a8 ReadFile 10321->10446 10322->10231 10324 405d61 3 API calls 10323->10324 10325 4035f7 10324->10325 10326 4035fd 10325->10326 10327 40360f 10325->10327 10528 4059a1 wsprintfA 10326->10528 10328 40592a 3 API calls 10327->10328 10329 403630 10328->10329 10330 40364e lstrcatA 10329->10330 10332 40592a 3 API calls 10329->10332 10333 40360d 10330->10333 10332->10330 10519 403897 10333->10519 10336 405617 18 API calls 10337 403676 10336->10337 10338 4036ff 10337->10338 10340 40592a 3 API calls 10337->10340 10339 405617 18 API calls 10338->10339 10341 403705 10339->10341 10342 4036a2 10340->10342 10343 403715 LoadImageA 10341->10343 10346 405a65 18 API calls 10341->10346 10342->10338 10350 4036be lstrlenA 10342->10350 10354 405561 CharNextA 10342->10354 10344 403740 RegisterClassA 10343->10344 10345 4037c9 10343->10345 10347 40377c SystemParametersInfoA CreateWindowExA 10344->10347 10348 40340d 10344->10348 10349 40140b 2 API calls 10345->10349 10346->10343 10347->10345 10348->10233 10353 4037cf 10349->10353 10351 4036f2 10350->10351 10352 4036cc lstrcmpiA 10350->10352 10357 405536 3 API calls 10351->10357 10352->10351 10356 4036dc GetFileAttributesA 10352->10356 10353->10348 10359 403897 19 API calls 10353->10359 10355 4036bc 10354->10355 10355->10350 10358 4036e8 10356->10358 10360 4036f8 10357->10360 10358->10351 10361 40557d 2 API calls 10358->10361 10362 4037e0 10359->10362 10529 405a43 lstrcpynA 10360->10529 10361->10351 10364 403864 10362->10364 10365 4037e8 ShowWindow LoadLibraryA 10362->10365 10530 404eb3 OleInitialize 10364->10530 10367 403807 LoadLibraryA 10365->10367 10368 40380e GetClassInfoA 10365->10368 10367->10368 10370 403822 GetClassInfoA RegisterClassA 10368->10370 10371 403838 DialogBoxParamA 10368->10371 10369 40386a 10372 403886 10369->10372 10373 40386e 10369->10373 10370->10371 10374 40140b 2 API calls 10371->10374 10376 40140b 2 API calls 10372->10376 10373->10348 10377 40140b 2 API calls 10373->10377 10375 403860 10374->10375 10375->10348 10376->10348 10377->10348 10378->10220 10545 405a43 lstrcpynA 10379->10545 10381 405628 10546 4055ca CharNextA CharNextA 10381->10546 10384 4033e3 10384->10233 10393 405a43 lstrcpynA 10384->10393 10385 405ca1 5 API calls 10391 40563e 10385->10391 10386 405669 lstrlenA 10387 405674 10386->10387 10386->10391 10388 405536 3 API calls 10387->10388 10390 405679 GetFileAttributesA 10388->10390 10390->10384 10391->10384 10391->10386 10392 40557d 2 API calls 10391->10392 10552 405d3a FindFirstFileA 10391->10552 10392->10386 10393->10264 10394->10236 10396 405319 10395->10396 10397 403434 ExitProcess 10396->10397 10398 40532d MessageBoxIndirectA 10396->10398 10398->10397 10399->10255 10400->10276 10402 405d61 3 API calls 10401->10402 10403 40579c 10402->10403 10404 4057a4 MoveFileExA 10403->10404 10405 4057b5 10403->10405 10404->10405 10406 4058ee 10404->10406 10407 4057d3 10405->10407 10408 4057f9 GetShortPathNameA 10405->10408 10406->10276 10555 40571a GetFileAttributesA CreateFileA 10407->10555 10408->10406 10409 40580e 10408->10409 10409->10406 10411 405816 wsprintfA 10409->10411 10413 405a65 18 API calls 10411->10413 10412 4057dd CloseHandle GetShortPathNameA 10412->10406 10414 4057f1 10412->10414 10415 40583e 10413->10415 10414->10406 10414->10408 10556 40571a GetFileAttributesA CreateFileA 10415->10556 10417 40584b 10417->10406 10418 40585a GetFileSize GlobalAlloc 10417->10418 10419 4058e7 CloseHandle 10418->10419 10420 405878 ReadFile 10418->10420 10419->10406 10420->10419 10421 40588c 10420->10421 10421->10419 10557 40568f lstrlenA 10421->10557 10424 4058a1 10562 405a43 lstrcpynA 10424->10562 10425 4058fb 10426 40568f 4 API calls 10425->10426 10428 4058af 10426->10428 10429 4058c2 SetFilePointer WriteFile GlobalFree 10428->10429 10429->10419 10431 4052d2 CloseHandle 10430->10431 10432 4052de 10430->10432 10431->10432 10432->10276 10434 401389 2 API calls 10433->10434 10435 401420 10434->10435 10435->10238 10437 405550 lstrcatA 10436->10437 10438 40320f CreateDirectoryA 10436->10438 10437->10438 10438->10291 10439->10295 10440->10297 10442 40558a 10441->10442 10443 402cc7 10442->10443 10444 40558f CharPrevA 10442->10444 10445 405a43 lstrcpynA 10443->10445 10444->10442 10444->10443 10445->10301 10447 4031c9 10446->10447 10447->10321 10449 402bd3 10448->10449 10450 402beb 10448->10450 10453 402be3 10449->10453 10454 402bdc DestroyWindow 10449->10454 10451 402bf3 10450->10451 10452 402bfb GetTickCount 10450->10452 10480 405d9a 10451->10480 10452->10453 10456 402c09 10452->10456 10453->10307 10453->10322 10479 4031da SetFilePointer 10453->10479 10454->10453 10457 402c11 10456->10457 10458 402c3e CreateDialogParamA 10456->10458 10457->10453 10484 402ba9 10457->10484 10458->10453 10460 402c1f wsprintfA 10487 404de1 10460->10487 10463->10319 10465 402f12 SetFilePointer 10464->10465 10466 402f2e 10464->10466 10465->10466 10498 40302c GetTickCount 10466->10498 10469 402f3f ReadFile 10470 402f5f 10469->10470 10475 402feb 10469->10475 10471 40302c 42 API calls 10470->10471 10470->10475 10472 402f76 10471->10472 10473 402ff1 ReadFile 10472->10473 10472->10475 10477 402f86 10472->10477 10473->10475 10475->10322 10476 402fa1 ReadFile 10476->10475 10476->10477 10477->10475 10477->10476 10478 402fba WriteFile 10477->10478 10478->10475 10478->10477 10479->10311 10481 405db7 PeekMessageA 10480->10481 10482 405dc7 10481->10482 10483 405dad DispatchMessageA 10481->10483 10482->10453 10483->10481 10485 402bb8 10484->10485 10486 402bba MulDiv 10484->10486 10485->10486 10486->10460 10488 404dfc 10487->10488 10497 402c3c 10487->10497 10489 404e19 lstrlenA 10488->10489 10490 405a65 18 API calls 10488->10490 10491 404e42 10489->10491 10492 404e27 lstrlenA 10489->10492 10490->10489 10494 404e55 10491->10494 10495 404e48 SetWindowTextA 10491->10495 10493 404e39 lstrcatA 10492->10493 10492->10497 10493->10491 10496 404e5b SendMessageA SendMessageA SendMessageA 10494->10496 10494->10497 10495->10494 10496->10497 10497->10453 10499 403196 10498->10499 10500 40305b 10498->10500 10501 402bc5 32 API calls 10499->10501 10511 4031da SetFilePointer 10500->10511 10507 402f37 10501->10507 10503 403066 SetFilePointer 10508 40308b 10503->10508 10504 4031a8 ReadFile 10504->10508 10506 402bc5 32 API calls 10506->10508 10507->10469 10507->10475 10508->10504 10508->10506 10508->10507 10509 403120 WriteFile 10508->10509 10510 403177 SetFilePointer 10508->10510 10512 405e5b 10508->10512 10509->10507 10509->10508 10510->10499 10511->10503 10513 405e80 10512->10513 10516 405e88 10512->10516 10513->10508 10514 405f18 GlobalAlloc 10514->10513 10514->10516 10515 405f0f GlobalFree 10515->10514 10516->10513 10516->10514 10516->10515 10517 405f86 GlobalFree 10516->10517 10518 405f8f GlobalAlloc 10516->10518 10517->10518 10518->10513 10518->10516 10520 4038ab 10519->10520 10537 4059a1 wsprintfA 10520->10537 10522 40391c 10523 405a65 18 API calls 10522->10523 10524 403928 SetWindowTextA 10523->10524 10525 403944 10524->10525 10526 40365e 10524->10526 10525->10526 10527 405a65 18 API calls 10525->10527 10526->10336 10527->10525 10528->10333 10529->10338 10538 403e83 10530->10538 10532 404efd 10533 403e83 SendMessageA 10532->10533 10535 404f0f OleUninitialize 10533->10535 10534 404ed6 10534->10532 10541 401389 10534->10541 10535->10369 10537->10522 10539 403e9b 10538->10539 10540 403e8c SendMessageA 10538->10540 10539->10534 10540->10539 10543 401390 10541->10543 10542 4013fe 10542->10534 10543->10542 10544 4013cb MulDiv SendMessageA 10543->10544 10544->10543 10545->10381 10547 4055e4 10546->10547 10551 4055f0 10546->10551 10548 4055eb CharNextA 10547->10548 10547->10551 10549 40560d 10548->10549 10549->10384 10549->10385 10550 405561 CharNextA 10550->10551 10551->10549 10551->10550 10553 405d50 FindClose 10552->10553 10554 405d5b 10552->10554 10553->10554 10554->10391 10555->10412 10556->10417 10558 4056c5 lstrlenA 10557->10558 10559 4056a3 lstrcmpiA 10558->10559 10560 4056cf 10558->10560 10559->10560 10561 4056bc CharNextA 10559->10561 10560->10424 10560->10425 10561->10558 10562->10428 12196 404d31 12197 404d56 12196->12197 12198 404d3f 12196->12198 12199 404d64 IsWindowVisible 12197->12199 12206 404d7b 12197->12206 12200 404d45 12198->12200 12214 404dbf 12198->12214 12201 404d71 12199->12201 12199->12214 12203 403e83 SendMessageA 12200->12203 12204 4046b0 5 API calls 12201->12204 12202 404dc5 CallWindowProcA 12205 404d4f 12202->12205 12203->12205 12204->12206 12206->12202 12215 405a43 lstrcpynA 12206->12215 12208 404daa 12216 4059a1 wsprintfA 12208->12216 12210 404db1 12211 40140b 2 API calls 12210->12211 12212 404db8 12211->12212 12217 405a43 lstrcpynA 12212->12217 12214->12202 12215->12208 12216->12210 12217->12214 10891 401734 10892 4029e8 18 API calls 10891->10892 10893 40173b 10892->10893 10894 401761 10893->10894 10895 401759 10893->10895 10931 405a43 lstrcpynA 10894->10931 10930 405a43 lstrcpynA 10895->10930 10898 40176c 10900 405536 3 API calls 10898->10900 10899 40175f 10902 405ca1 5 API calls 10899->10902 10901 401772 lstrcatA 10900->10901 10901->10899 10924 40177e 10902->10924 10903 405d3a 2 API calls 10903->10924 10905 4056fb 2 API calls 10905->10924 10906 401795 CompareFileTime 10906->10924 10907 401859 10909 404de1 25 API calls 10907->10909 10908 401830 10910 404de1 25 API calls 10908->10910 10917 401845 10908->10917 10911 401863 10909->10911 10910->10917 10912 402f01 47 API calls 10911->10912 10913 401876 10912->10913 10914 40188a SetFileTime 10913->10914 10916 40189c FindCloseChangeNotification 10913->10916 10914->10916 10915 405a65 18 API calls 10915->10924 10916->10917 10918 4018ad 10916->10918 10920 4018b2 10918->10920 10921 4018c5 10918->10921 10919 405a43 lstrcpynA 10919->10924 10922 405a65 18 API calls 10920->10922 10923 405a65 18 API calls 10921->10923 10925 4018ba lstrcatA 10922->10925 10926 4018cd 10923->10926 10924->10903 10924->10905 10924->10906 10924->10907 10924->10908 10924->10915 10924->10919 10927 405304 MessageBoxIndirectA 10924->10927 10929 40571a GetFileAttributesA CreateFileA 10924->10929 10925->10926 10926->10917 10928 405304 MessageBoxIndirectA 10926->10928 10927->10924 10928->10917 10929->10924 10930->10899 10931->10898 12221 401934 12222 4029cb 18 API calls 12221->12222 12223 40193b 12222->12223 12224 4029cb 18 API calls 12223->12224 12225 401945 12224->12225 12226 4029e8 18 API calls 12225->12226 12227 40194e 12226->12227 12228 401961 lstrlenA 12227->12228 12229 40199c 12227->12229 12230 40196b 12228->12230 12230->12229 12234 405a43 lstrcpynA 12230->12234 12232 401985 12232->12229 12233 401992 lstrlenA 12232->12233 12233->12229 12234->12232 12392 4018d8 12393 40190f 12392->12393 12394 4029e8 18 API calls 12393->12394 12395 401914 12394->12395 12396 405368 69 API calls 12395->12396 12397 40191d 12396->12397 10932 4022f5 10933 4022fb 10932->10933 10934 4029e8 18 API calls 10933->10934 10935 40230d 10934->10935 10936 4029e8 18 API calls 10935->10936 10937 402317 RegCreateKeyExA 10936->10937 10938 402341 10937->10938 10939 40287d 10937->10939 10940 402359 10938->10940 10941 4029e8 18 API calls 10938->10941 10945 402365 10940->10945 10949 4029cb 10940->10949 10942 402352 lstrlenA 10941->10942 10942->10940 10944 402380 RegSetValueExA 10946 402396 RegCloseKey 10944->10946 10945->10944 10947 402f01 47 API calls 10945->10947 10946->10939 10947->10944 10950 405a65 18 API calls 10949->10950 10951 4029df 10950->10951 10951->10945 12655 4027f5 12656 4029cb 18 API calls 12655->12656 12657 4027fb 12656->12657 12658 40282c 12657->12658 12660 40264e 12657->12660 12661 402809 12657->12661 12659 405a65 18 API calls 12658->12659 12658->12660 12659->12660 12661->12660 12663 4059a1 wsprintfA 12661->12663 12663->12660 10636 401389 10638 401390 10636->10638 10637 4013fe 10638->10637 10639 4013cb MulDiv SendMessageA 10638->10639 10639->10638 12728 40248e 12729 4029e8 18 API calls 12728->12729 12730 402495 12729->12730 12733 40571a GetFileAttributesA CreateFileA 12730->12733 12732 4024a1 12733->12732 12770 401e95 12771 4029e8 18 API calls 12770->12771 12772 401e9c 12771->12772 12773 405d3a 2 API calls 12772->12773 12774 401ea2 12773->12774 12776 401eb4 12774->12776 12777 4059a1 wsprintfA 12774->12777 12777->12776 12804 401696 12805 4029e8 18 API calls 12804->12805 12806 40169c GetFullPathNameA 12805->12806 12807 4016b3 12806->12807 12808 4016d4 12806->12808 12807->12808 12811 405d3a 2 API calls 12807->12811 12809 4016e8 GetShortPathNameA 12808->12809 12810 40287d 12808->12810 12809->12810 12812 4016c4 12811->12812 12812->12808 12814 405a43 lstrcpynA 12812->12814 12814->12808 11211 402299 11212 4022c9 11211->11212 11213 40229e 11211->11213 11215 4029e8 18 API calls 11212->11215 11214 402af2 19 API calls 11213->11214 11216 4022a5 11214->11216 11217 4022d0 11215->11217 11218 4029e8 18 API calls 11216->11218 11221 4022e6 11216->11221 11222 402a28 RegOpenKeyExA 11217->11222 11219 4022b6 RegDeleteValueA RegCloseKey 11218->11219 11219->11221 11223 402abc 11222->11223 11225 402a53 11222->11225 11223->11221 11224 402a79 RegEnumKeyA 11224->11225 11226 402a8b RegCloseKey 11224->11226 11225->11224 11225->11226 11227 402ab0 RegCloseKey 11225->11227 11229 402a28 3 API calls 11225->11229 11228 405d61 3 API calls 11226->11228 11231 402a9f 11227->11231 11230 402a9b 11228->11230 11229->11225 11230->11231 11232 402acb RegDeleteKeyA 11230->11232 11231->11223 11232->11231 9674 4023a1 9685 402af2 9674->9685 9676 4023ab 9677 4029e8 18 API calls 9676->9677 9678 4023b4 9677->9678 9679 4023be RegQueryValueExA 9678->9679 9683 40264e 9678->9683 9680 4023e4 RegCloseKey 9679->9680 9681 4023de 9679->9681 9680->9683 9681->9680 9689 4059a1 wsprintfA 9681->9689 9686 4029e8 18 API calls 9685->9686 9687 402b0b 9686->9687 9688 402b19 RegOpenKeyExA 9687->9688 9688->9676 9689->9680 10586 4035a6 10587 4035c1 10586->10587 10588 4035b7 CloseHandle 10586->10588 10589 4035d5 10587->10589 10590 4035cb CloseHandle 10587->10590 10588->10587 10593 405368 10589->10593 10590->10589 10594 405617 18 API calls 10593->10594 10595 40537c 10594->10595 10596 405385 DeleteFileA 10595->10596 10597 40539c 10595->10597 10626 4035e1 10596->10626 10598 4054d1 10597->10598 10631 405a43 lstrcpynA 10597->10631 10605 405d3a 2 API calls 10598->10605 10598->10626 10600 4053c6 10601 4053d7 10600->10601 10602 4053ca lstrcatA 10600->10602 10604 40557d 2 API calls 10601->10604 10603 4053dd 10602->10603 10606 4053eb lstrcatA 10603->10606 10608 4053f6 lstrlenA FindFirstFileA 10603->10608 10604->10603 10607 4054f6 10605->10607 10606->10608 10609 405536 3 API calls 10607->10609 10607->10626 10608->10598 10613 40541a 10608->10613 10611 405500 10609->10611 10610 405561 CharNextA 10610->10613 10612 4056fb 2 API calls 10611->10612 10614 405506 RemoveDirectoryA 10612->10614 10613->10610 10619 4054b0 FindNextFileA 10613->10619 10625 405368 60 API calls 10613->10625 10628 404de1 25 API calls 10613->10628 10629 404de1 25 API calls 10613->10629 10630 405791 39 API calls 10613->10630 10632 405a43 lstrcpynA 10613->10632 10633 4056fb GetFileAttributesA 10613->10633 10615 405511 10614->10615 10616 405528 10614->10616 10620 404de1 25 API calls 10615->10620 10615->10626 10618 404de1 25 API calls 10616->10618 10618->10626 10619->10613 10621 4054c8 FindClose 10619->10621 10622 40551f 10620->10622 10621->10598 10623 405791 39 API calls 10622->10623 10623->10626 10625->10613 10628->10619 10629->10613 10630->10613 10631->10600 10632->10613 10634 40547d DeleteFileA 10633->10634 10635 40570a SetFileAttributesA 10633->10635 10634->10613 10635->10634 10872 4015b3 10873 4029e8 18 API calls 10872->10873 10874 4015ba 10873->10874 10875 4055ca 4 API calls 10874->10875 10887 4015c2 10875->10887 10876 40160a 10877 40162d 10876->10877 10878 40160f 10876->10878 10882 401423 25 API calls 10877->10882 10880 401423 25 API calls 10878->10880 10879 405561 CharNextA 10881 4015d0 CreateDirectoryA 10879->10881 10883 401616 10880->10883 10884 4015e5 GetLastError 10881->10884 10881->10887 10889 40215b 10882->10889 10890 405a43 lstrcpynA 10883->10890 10886 4015f2 GetFileAttributesA 10884->10886 10884->10887 10886->10887 10887->10876 10887->10879 10888 401621 SetCurrentDirectoryA 10888->10889 10890->10888 10952 2f24505 10954 2f24521 10952->10954 10956 2f24518 10952->10956 10954->10956 10957 2f24549 10954->10957 10960 2f2442c 10954->10960 10955 2f24569 10955->10957 10959 2f2442c 105 API calls 10955->10959 10956->10955 10956->10957 10958 2f2442c 105 API calls 10956->10958 10958->10955 10959->10957 10961 2f244c1 10960->10961 10962 2f24439 GetVersion 10960->10962 10964 2f244f3 10961->10964 10967 2f244c7 10961->10967 10989 2f261f2 HeapCreate 10962->10989 10971 2f2448c 10964->10971 11090 2f27668 10964->11090 10965 2f2444b 10965->10971 11001 2f2757c 10965->11001 10966 2f244e2 11048 2f27a1c 10966->11048 10967->10966 10967->10971 11087 2f24613 10967->11087 10971->10956 10973 2f24483 10975 2f24490 GetCommandLineA 10973->10975 10976 2f24487 10973->10976 11011 2f27d76 10975->11011 11058 2f2624f 10976->11058 10982 2f2624f 6 API calls 10982->10971 10984 2f244aa 11065 2f27b29 10984->11065 10986 2f244af 11074 2f27a70 10986->11074 10988 2f244b4 10988->10971 10990 2f26212 10989->10990 10991 2f26248 10989->10991 11112 2f260aa 10990->11112 10991->10965 10994 2f26221 11124 2f262f7 HeapAlloc 10994->11124 10995 2f2622e 10996 2f2624b 10995->10996 10999 2f26e3e 5 API calls 10995->10999 10996->10965 10998 2f2622b 10998->10996 11000 2f2623c HeapDestroy 10998->11000 10999->10998 11000->10991 11160 2f254d9 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 11001->11160 11003 2f27582 TlsAlloc 11004 2f27592 11003->11004 11005 2f275cc 11003->11005 11006 2f29681 30 API calls 11004->11006 11005->10973 11007 2f2759b 11006->11007 11007->11005 11008 2f275a3 TlsSetValue 11007->11008 11008->11005 11009 2f275b4 11008->11009 11010 2f275ba GetCurrentThreadId 11009->11010 11010->10973 11012 2f27d91 GetEnvironmentStringsW 11011->11012 11013 2f27dc4 11011->11013 11014 2f27da5 GetEnvironmentStrings 11012->11014 11015 2f27d99 11012->11015 11013->11015 11016 2f27db5 11013->11016 11014->11016 11017 2f244a0 11014->11017 11018 2f27dd1 GetEnvironmentStringsW 11015->11018 11021 2f27ddd 11015->11021 11016->11017 11019 2f27e57 GetEnvironmentStrings 11016->11019 11024 2f27e63 11016->11024 11034 2f27860 11017->11034 11018->11017 11018->11021 11019->11017 11019->11024 11020 2f27df2 WideCharToMultiByte 11022 2f27e43 FreeEnvironmentStringsW 11020->11022 11023 2f27e11 11020->11023 11021->11020 11021->11021 11022->11017 11026 2f23ea7 29 API calls 11023->11026 11025 2f23ea7 29 API calls 11024->11025 11032 2f27e7e 11025->11032 11027 2f27e17 11026->11027 11027->11022 11028 2f27e20 WideCharToMultiByte 11027->11028 11030 2f27e31 11028->11030 11031 2f27e3a 11028->11031 11029 2f27e94 FreeEnvironmentStringsA 11029->11017 11033 2f23dbe 29 API calls 11030->11033 11031->11022 11032->11029 11033->11031 11035 2f23ea7 29 API calls 11034->11035 11036 2f27873 11035->11036 11037 2f27881 GetStartupInfoA 11036->11037 11038 2f245a2 7 API calls 11036->11038 11044 2f279a0 11037->11044 11047 2f278cf 11037->11047 11038->11037 11040 2f279cb GetStdHandle 11043 2f279d9 GetFileType 11040->11043 11040->11044 11041 2f27a0b SetHandleCount 11041->10984 11042 2f23ea7 29 API calls 11042->11047 11043->11044 11044->11040 11044->11041 11045 2f27946 11045->11044 11046 2f27968 GetFileType 11045->11046 11046->11045 11047->11042 11047->11044 11047->11045 11050 2f27a24 11048->11050 11049 2f244e7 11053 2f275d0 11049->11053 11050->11049 11051 2f23dbe 29 API calls 11050->11051 11052 2f27a3e DeleteCriticalSection 11050->11052 11051->11050 11052->11050 11161 2f25502 11053->11161 11055 2f275d5 11056 2f275df TlsFree 11055->11056 11057 2f244ec 11055->11057 11056->11057 11057->10982 11059 2f262c1 11058->11059 11060 2f2625b 11058->11060 11061 2f262e8 HeapDestroy 11059->11061 11064 2f262d4 VirtualFree 11059->11064 11062 2f262ad HeapFree 11060->11062 11063 2f2627b VirtualFree VirtualFree HeapFree 11060->11063 11061->10971 11062->11061 11063->11062 11063->11063 11064->11059 11066 2f27b40 GetModuleFileNameA 11065->11066 11067 2f27b3b 11065->11067 11069 2f27b63 11066->11069 11166 2f29bad 11067->11166 11070 2f23ea7 29 API calls 11069->11070 11071 2f27b84 11070->11071 11072 2f245a2 7 API calls 11071->11072 11073 2f27b94 11071->11073 11072->11073 11073->10986 11075 2f27a7d 11074->11075 11077 2f27a82 11074->11077 11076 2f29bad 48 API calls 11075->11076 11076->11077 11078 2f23ea7 29 API calls 11077->11078 11079 2f27aaf 11078->11079 11080 2f245a2 7 API calls 11079->11080 11085 2f27ac3 11079->11085 11080->11085 11081 2f27b06 11082 2f23dbe 29 API calls 11081->11082 11083 2f27b12 11082->11083 11083->10988 11084 2f23ea7 29 API calls 11084->11085 11085->11081 11085->11084 11086 2f245a2 7 API calls 11085->11086 11086->11085 11195 2f24622 11087->11195 11091 2f27676 11090->11091 11092 2f27707 11090->11092 11093 2f2767f TlsGetValue 11091->11093 11094 2f2768c 11091->11094 11092->10971 11093->11094 11095 2f276f8 TlsSetValue 11093->11095 11096 2f27699 11094->11096 11097 2f23dbe 29 API calls 11094->11097 11095->11092 11098 2f276a7 11096->11098 11100 2f23dbe 29 API calls 11096->11100 11097->11096 11099 2f276b5 11098->11099 11101 2f23dbe 29 API calls 11098->11101 11102 2f276c3 11099->11102 11103 2f23dbe 29 API calls 11099->11103 11100->11098 11101->11099 11104 2f276d1 11102->11104 11105 2f23dbe 29 API calls 11102->11105 11103->11102 11106 2f23dbe 29 API calls 11104->11106 11109 2f276df 11104->11109 11105->11104 11106->11109 11107 2f23dbe 29 API calls 11110 2f276f0 11107->11110 11108 2f23dbe 29 API calls 11111 2f276f7 11108->11111 11109->11107 11109->11110 11110->11108 11111->11095 11126 2f23ab0 11112->11126 11115 2f260d3 11116 2f260ed GetEnvironmentVariableA 11115->11116 11119 2f260e5 11115->11119 11117 2f261ca 11116->11117 11118 2f2610c 11116->11118 11117->11119 11131 2f2607d GetModuleHandleA 11117->11131 11121 2f26151 GetModuleFileNameA 11118->11121 11122 2f26149 11118->11122 11119->10994 11119->10995 11121->11122 11122->11117 11128 2f28f5a 11122->11128 11125 2f26313 11124->11125 11125->10998 11127 2f23abc GetVersionExA 11126->11127 11127->11115 11127->11116 11133 2f28f71 11128->11133 11132 2f26094 11131->11132 11132->11119 11135 2f28f89 11133->11135 11134 2f25464 6 API calls 11134->11135 11135->11134 11138 2f28fb9 11135->11138 11136 2f28f6d 11136->11117 11137 2f25464 6 API calls 11137->11138 11138->11136 11138->11137 11139 2f290e2 11138->11139 11142 2f2a2e1 11138->11142 11139->11136 11141 2f29cc5 35 API calls 11139->11141 11141->11136 11143 2f2a2ff InterlockedIncrement 11142->11143 11147 2f2a2ec 11142->11147 11144 2f2a31b InterlockedDecrement 11143->11144 11148 2f2a325 11143->11148 11145 2f2556e 29 API calls 11144->11145 11145->11148 11147->11138 11153 2f2a350 11148->11153 11150 2f2a345 InterlockedDecrement 11150->11147 11151 2f2a33b 11159 2f255cf LeaveCriticalSection 11151->11159 11155 2f2a37b 11153->11155 11158 2f2a332 11153->11158 11154 2f2a397 11157 2f255e4 9 API calls 11154->11157 11154->11158 11155->11154 11156 2f25464 6 API calls 11155->11156 11156->11154 11157->11158 11158->11150 11158->11151 11159->11147 11160->11003 11165 2f2550f 11161->11165 11162 2f2554b DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection 11162->11055 11163 2f25535 DeleteCriticalSection 11164 2f23dbe 29 API calls 11163->11164 11164->11165 11165->11162 11165->11163 11167 2f29bb6 11166->11167 11168 2f29bbd 11166->11168 11170 2f297d5 11167->11170 11168->11066 11171 2f2556e 29 API calls 11170->11171 11172 2f297e5 11171->11172 11181 2f29982 11172->11181 11174 2f297fc 11194 2f255cf LeaveCriticalSection 11174->11194 11177 2f2997a 11177->11168 11179 2f29821 GetCPInfo 11180 2f29837 11179->11180 11180->11174 11186 2f29a28 GetCPInfo 11180->11186 11182 2f299a2 11181->11182 11183 2f29992 GetOEMCP 11181->11183 11184 2f297ed 11182->11184 11185 2f299a7 GetACP 11182->11185 11183->11182 11184->11174 11184->11179 11184->11180 11185->11184 11187 2f29b13 11186->11187 11188 2f29a4b 11186->11188 11187->11174 11189 2f28b9e 6 API calls 11188->11189 11190 2f29ac7 11189->11190 11191 2f255e4 9 API calls 11190->11191 11192 2f29aeb 11191->11192 11193 2f255e4 9 API calls 11192->11193 11193->11187 11194->11177 11204 2f246c7 11195->11204 11198 2f24633 GetCurrentProcess TerminateProcess 11199 2f24644 11198->11199 11200 2f246b5 ExitProcess 11199->11200 11201 2f246ae 11199->11201 11207 2f246d0 11201->11207 11205 2f2556e 29 API calls 11204->11205 11206 2f24628 11205->11206 11206->11198 11206->11199 11210 2f255cf LeaveCriticalSection 11207->11210 11209 2f2461e 11209->10966 11210->11209

                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                        Function 00403225 Relevance: 73.8, APIs: 24, Strings: 18, Instructions: 270filestringcomCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 0 403225-4032ba #17 SetErrorMode OleInitialize call 405d61 SHGetFileInfoA call 405a43 GetCommandLineA call 405a43 GetModuleHandleA 7 4032c6-4032db call 405561 CharNextA 0->7 8 4032bc-4032c1 0->8 11 403340-403344 7->11 8->7 12 403346 11->12 13 4032dd-4032e0 11->13 16 403359-403371 GetTempPathA call 4031f1 12->16 14 4032e2-4032e6 13->14 15 4032e8-4032f0 13->15 14->14 14->15 17 4032f2-4032f3 15->17 18 4032f8-4032fb 15->18 25 403393-4033aa DeleteFileA call 402c5b 16->25 26 403373-403391 GetWindowsDirectoryA lstrcatA call 4031f1 16->26 17->18 20 403330-40333d call 405561 18->20 21 4032fd-403301 18->21 20->11 38 40333f 20->38 23 403311-403317 21->23 24 403303-40330c 21->24 30 403327-40332e 23->30 31 403319-403322 23->31 24->23 28 40330e 24->28 40 403411-403420 ExitProcess OleUninitialize 25->40 41 4033ac-4033b2 25->41 26->25 26->40 28->23 30->20 36 403348-403354 call 405a43 30->36 31->30 35 403324 31->35 35->30 36->16 38->11 42 403426-403436 call 405304 ExitProcess 40->42 43 40350b-403511 40->43 44 403401-403408 call 4035e3 41->44 45 4033b4-4033bd call 405561 41->45 47 403513-403530 call 405d61 * 3 43->47 48 40358e-403596 43->48 56 40340d 44->56 57 4033c8-4033ca 45->57 73 403532-403534 47->73 74 40357a-403585 ExitWindowsEx 47->74 51 403598 48->51 52 40359c-4035a0 ExitProcess 48->52 51->52 56->40 59 4033cc-4033d6 57->59 60 4033bf-4033c5 57->60 64 4033d8-4033e5 call 405617 59->64 65 40343c-403456 lstrcatA lstrcmpiA 59->65 60->59 63 4033c7 60->63 63->57 64->40 76 4033e7-4033fd call 405a43 * 2 64->76 65->40 67 403458-40346d CreateDirectoryA SetCurrentDirectoryA 65->67 70 40347a-403494 call 405a43 67->70 71 40346f-403475 call 405a43 67->71 84 403499-4034b5 call 405a65 DeleteFileA 70->84 71->70 73->74 78 403536-403538 73->78 74->48 81 403587-403589 call 40140b 74->81 76->44 78->74 82 40353a-40354c GetCurrentProcess 78->82 81->48 82->74 91 40354e-403570 82->91 92 4034f6-4034fd 84->92 93 4034b7-4034c7 CopyFileA 84->93 91->74 92->84 94 4034ff-403506 call 405791 92->94 93->92 95 4034c9-4034e9 call 405791 call 405a65 call 4052a3 93->95 94->40 95->92 105 4034eb-4034f2 CloseHandle 95->105 105->92
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • #17.COMCTL32 ref: 00403244
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(00008001), ref: 0040324F
                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00403256
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        • SHGetFileInfoA.SHELL32(0041F4B8,00000000,?,00000160,00000000,00000008), ref: 0040327E
                                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                                        • GetCommandLineA.KERNEL32(00423700,NSIS Error), ref: 00403293
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000000), ref: 004032A6
                                                                                                                                                                                                        • CharNextA.USER32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000020), ref: 004032D1
                                                                                                                                                                                                        • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403364
                                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403379
                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403385
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(2052), ref: 00403398
                                                                                                                                                                                                        • ExitProcess.KERNEL32(00000000), ref: 00403411
                                                                                                                                                                                                        • OleUninitialize.OLE32(00000000), ref: 00403416
                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403436
                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000000,00000000), ref: 00403442
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Program Files (x86)\360\360Desktop\modules), ref: 0040344E
                                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040345A
                                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403461
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(0041F0B8,0041F0B8,?,08bcc5cf9e3fc589107741a5e999ecfa,?), ref: 004034AB
                                                                                                                                                                                                        • CopyFileA.KERNEL32(C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,0041F0B8,00000001), ref: 004034BF
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,0041F0B8,0041F0B8,?,0041F0B8,00000000), ref: 004034EC
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403541
                                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,00000000), ref: 0040357D
                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004035A0
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExitFileProcess$DirectoryHandle$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                                                                                                                                                                                        • String ID: /D=$ _?=$"$"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$08bcc5cf9e3fc589107741a5e999ecfa$2052$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\360bizhi$C:\Users\user\AppData\Roaming\360wp\User Data$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
                                                                                                                                                                                                        • API String ID: 553446912-404493318
                                                                                                                                                                                                        • Opcode ID: f1dc0173ad89198c85e38e49cb9c8fc9ce30ec73a9de808b9ea016f6acfa90af
                                                                                                                                                                                                        • Instruction ID: 12b4adbb734880863a6c7b42456f84a79c3c9dcdf907d3cda67c8baecb7e3ac4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1dc0173ad89198c85e38e49cb9c8fc9ce30ec73a9de808b9ea016f6acfa90af
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD91C370A08351BFD721AFA1AD89B1B7EACAB40306F44453BF541B61D2C77C9E418B6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405368 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 284 405368-405383 call 405617 287 405385-405397 DeleteFileA 284->287 288 40539c-4053a6 284->288 289 405530-405533 287->289 290 4053a8-4053aa 288->290 291 4053ba-4053c8 call 405a43 288->291 292 4053b0-4053b4 290->292 293 4054db-4054e1 290->293 297 4053d7-4053d8 call 40557d 291->297 298 4053ca-4053d5 lstrcatA 291->298 292->291 292->293 293->289 295 4054e3-4054e6 293->295 299 4054f0-4054f8 call 405d3a 295->299 300 4054e8-4054ee 295->300 301 4053dd-4053e0 297->301 298->301 299->289 308 4054fa-40550f call 405536 call 4056fb RemoveDirectoryA 299->308 300->289 304 4053e2-4053e9 301->304 305 4053eb-4053f1 lstrcatA 301->305 304->305 307 4053f6-405414 lstrlenA FindFirstFileA 304->307 305->307 309 4054d1-4054d5 307->309 310 40541a-405431 call 405561 307->310 320 405511-405515 308->320 321 405528-40552b call 404de1 308->321 309->293 312 4054d7 309->312 318 405433-405437 310->318 319 40543c-40543f 310->319 312->293 318->319 322 405439 318->322 323 405441-405446 319->323 324 405452-405460 call 405a43 319->324 320->300 326 405517-405526 call 404de1 call 405791 320->326 321->289 322->319 328 4054b0-4054c2 FindNextFileA 323->328 329 405448-40544a 323->329 334 405462-40546a 324->334 335 405477-405486 call 4056fb DeleteFileA 324->335 326->289 328->310 332 4054c8-4054cb FindClose 328->332 329->324 333 40544c-405450 329->333 332->309 333->324 333->328 334->328 337 40546c-405475 call 405368 334->337 344 4054a8-4054ab call 404de1 335->344 345 405488-40548c 335->345 337->328 344->328 347 4054a0-4054a6 345->347 348 40548e-40549e call 404de1 call 405791 345->348 347->328 348->328
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 00405386
                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 004053D0
                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 004053F1
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 004053F7
                                                                                                                                                                                                        • FindFirstFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\*.*,?,?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 00405408
                                                                                                                                                                                                        • FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 004054BA
                                                                                                                                                                                                        • FindClose.KERNEL32(?), ref: 004054CB
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\*.*$\*.*
                                                                                                                                                                                                        • API String ID: 2035342205-4148153596
                                                                                                                                                                                                        • Opcode ID: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                                        • Instruction ID: 005fd70f037958758636dfc326b5af0e8b30b209f19d8c1cd7988b565b373fb6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1B51E030904A447ADB216B618C89BFF3A68DF4271AF54807BF945711D2C77C4982DE6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405D3A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindFirstFileA.KERNEL32(?,00422550,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 00405D45
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405D51
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                        • String ID: C:\$P%B
                                                                                                                                                                                                        • API String ID: 2295610775-2202030105
                                                                                                                                                                                                        • Opcode ID: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                                        • Instruction ID: fa9aa61da9af08e62d153dff6cda9e4686c5a383a1128ef99b384ed87a871bf9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6DD0C9319095206BC20027286D0C84B6A59DF09330710CA73B12AF22F0D27499628AA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040600A Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                                        • Instruction ID: 4dd2872783d64c99001b1edb157d711bf7c17726e9b979133eda9d6147b50661
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DF15671D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004035E3 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 213stringregistrylibraryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 106 4035e3-4035fb call 405d61 109 4035fd-40360d call 4059a1 106->109 110 40360f-403636 call 40592a 106->110 118 403659-403678 call 403897 call 405617 109->118 114 403638-403649 call 40592a 110->114 115 40364e-403654 lstrcatA 110->115 114->115 115->118 124 40367e-403683 118->124 125 4036ff-403707 call 405617 118->125 124->125 126 403685-40369d call 40592a 124->126 131 403715-40373a LoadImageA 125->131 132 403709-403710 call 405a65 125->132 130 4036a2-4036a9 126->130 130->125 135 4036ab-4036ad 130->135 133 403740-403776 RegisterClassA 131->133 134 4037c9-4037d1 call 40140b 131->134 132->131 137 40377c-4037c4 SystemParametersInfoA CreateWindowExA 133->137 138 40388d 133->138 149 4037d3-4037d6 134->149 150 4037db-4037e6 call 403897 134->150 140 4036be-4036ca lstrlenA 135->140 141 4036af-4036bc call 405561 135->141 137->134 145 40388f-403896 138->145 142 4036f2-4036fa call 405536 call 405a43 140->142 143 4036cc-4036da lstrcmpiA 140->143 141->140 142->125 143->142 148 4036dc-4036e6 GetFileAttributesA 143->148 152 4036e8-4036ea 148->152 153 4036ec-4036ed call 40557d 148->153 149->145 159 403864-40386c call 404eb3 150->159 160 4037e8-403805 ShowWindow LoadLibraryA 150->160 152->142 152->153 153->142 167 403886-403888 call 40140b 159->167 168 40386e-403874 159->168 162 403807-40380c LoadLibraryA 160->162 163 40380e-403820 GetClassInfoA 160->163 162->163 165 403822-403832 GetClassInfoA RegisterClassA 163->165 166 403838-403862 DialogBoxParamA call 40140b 163->166 165->166 166->145 167->138 168->149 171 40387a-403881 call 40140b 168->171 171->149
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        • lstrcatA.KERNEL32(2052,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403654
                                                                                                                                                                                                        • lstrlenA.KERNEL32(zhuomian,?,?,?,zhuomian,00000000,C:\Users\user\AppData\Roaming\360bizhi,2052,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian), ref: 004036BF
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 004036D2
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(zhuomian), ref: 004036DD
                                                                                                                                                                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\360bizhi), ref: 00403726
                                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                                        • RegisterClassA.USER32 ref: 0040376D
                                                                                                                                                                                                        • SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403785
                                                                                                                                                                                                        • CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037BE
                                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 004037F0
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd20), ref: 00403801
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd32), ref: 0040380C
                                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,004236A0), ref: 0040381C
                                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit,004236A0), ref: 00403829
                                                                                                                                                                                                        • RegisterClassA.USER32(004236A0), ref: 00403832
                                                                                                                                                                                                        • DialogBoxParamA.USER32(?,00000000,00403964,00000000), ref: 00403851
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$.DEFAULT\Control Panel\International$.exe$2052$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\360bizhi$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$zhuomian
                                                                                                                                                                                                        • API String ID: 914957316-3199241419
                                                                                                                                                                                                        • Opcode ID: 97f1c0a895908061ccf181a955fc906cb901a1c76f7d9b3106eede6371099e0d
                                                                                                                                                                                                        • Instruction ID: 94625ed8aaa298a99e1261382a478c85dd538f94d9e759fa5c435ea2279a3c1b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97f1c0a895908061ccf181a955fc906cb901a1c76f7d9b3106eede6371099e0d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D61B3B1604200BED620AF65AD45E2B3AADEB4474AF44447FF940B22E1D77D9E018A2E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402C5B Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 175 402c5b-402ca9 GetTickCount GetModuleFileNameA call 40571a 178 402cb5-402ce3 call 405a43 call 40557d call 405a43 GetFileSize 175->178 179 402cab-402cb0 175->179 187 402dd3-402de1 call 402bc5 178->187 188 402ce9-402d00 178->188 180 402efa-402efe 179->180 195 402eb2-402eb7 187->195 196 402de7-402dea 187->196 189 402d02 188->189 190 402d04-402d0a call 4031a8 188->190 189->190 194 402d0f-402d11 190->194 197 402d17-402d1d 194->197 198 402e6e-402e76 call 402bc5 194->198 195->180 199 402e16-402e62 GlobalAlloc call 405e3b call 405749 CreateFileA 196->199 200 402dec-402e04 call 4031da call 4031a8 196->200 201 402d9d-402da1 197->201 202 402d1f-402d37 call 4056db 197->202 198->195 226 402e64-402e69 199->226 227 402e78-402ea8 call 4031da call 402f01 199->227 200->195 223 402e0a-402e10 200->223 207 402da3-402da9 call 402bc5 201->207 208 402daa-402db0 201->208 202->208 221 402d39-402d40 202->221 207->208 214 402db2-402dc0 call 405dcd 208->214 215 402dc3-402dcd 208->215 214->215 215->187 215->188 221->208 225 402d42-402d49 221->225 223->195 223->199 225->208 228 402d4b-402d52 225->228 226->180 234 402ead-402eb0 227->234 228->208 230 402d54-402d5b 228->230 230->208 233 402d5d-402d7d 230->233 233->195 235 402d83-402d87 233->235 234->195 236 402eb9-402eca 234->236 237 402d89-402d8d 235->237 238 402d8f-402d97 235->238 240 402ed2-402ed7 236->240 241 402ecc 236->241 237->187 237->238 238->208 239 402d99-402d9b 238->239 239->208 242 402ed8-402ede 240->242 241->240 242->242 243 402ee0-402ef8 call 4056db 242->243 243->180
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402C6F
                                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,00000400), ref: 00402C8B
                                                                                                                                                                                                          • Part of subcall function 0040571A: GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                                          • Part of subcall function 0040571A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 00402CD4
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00409190), ref: 00402E1B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe, xrefs: 00402C75, 00402C84, 00402C98, 00402CB5
                                                                                                                                                                                                        • The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t, xrefs: 00402EB2
                                                                                                                                                                                                        • Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E64
                                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 00402CB6, 00402CBB, 00402CC1
                                                                                                                                                                                                        • Error launching installer, xrefs: 00402CAB
                                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian, xrefs: 00402C68
                                                                                                                                                                                                        • soft, xrefs: 00402D4B
                                                                                                                                                                                                        • Inst, xrefs: 00402D42
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5B, 00402E33
                                                                                                                                                                                                        • !9, xrefs: 00402EE0
                                                                                                                                                                                                        • Null, xrefs: 00402D54
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe$C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Null$The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t$soft$!9
                                                                                                                                                                                                        • API String ID: 2803837635-1569006302
                                                                                                                                                                                                        • Opcode ID: 5fb05577fb859e6eb9f36d83186ada6f4c098edcd536b112a9abc2a7ce8c9c66
                                                                                                                                                                                                        • Instruction ID: 98420d4c95cb0715ed39ffe41bcd432428fd7d62b31351ae7306db0730cac7b6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5fb05577fb859e6eb9f36d83186ada6f4c098edcd536b112a9abc2a7ce8c9c66
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C61C231E40214ABDB20DF64EE49B9A7BB4AB48315F50413BF904B72D1D7BC9E418BAD
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405791 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 144filememoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 246 405791-4057a2 call 405d61 249 4057a4-4057af MoveFileExA 246->249 250 4057b5-4057d1 246->250 249->250 251 4058ee 249->251 252 4057d3-4057eb call 40571a CloseHandle GetShortPathNameA 250->252 253 4057f9-405808 GetShortPathNameA 250->253 254 4058f4-4058f8 251->254 252->254 260 4057f1-4057f3 252->260 253->254 255 40580e-405810 253->255 255->254 257 405816-405854 wsprintfA call 405a65 call 40571a 255->257 257->251 264 40585a-405876 GetFileSize GlobalAlloc 257->264 260->253 260->254 265 4058e7-4058e8 CloseHandle 264->265 266 405878-40588a ReadFile 264->266 265->251 266->265 267 40588c-405890 266->267 267->265 268 405892-40589f call 40568f 267->268 271 4058a1-4058af call 405a43 268->271 272 4058fb-40590b call 40568f 268->272 277 4058b2 271->277 272->277 278 40590d-405915 272->278 279 4058b4-4058e1 call 4056db SetFilePointer WriteFile GlobalFree 277->279 280 405922-405928 278->280 281 405917-405920 278->281 279->265 280->279 281->280 281->281
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        • MoveFileExA.KERNEL32(00000000,?,00000005,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057AB
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057DE
                                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(?,00422690,00000400), ref: 004057E7
                                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(00000000,00422108,00000400), ref: 00405804
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405822
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00422108,C0000000,00000004,00422108,?,?,?,00000000,000000F1,?), ref: 0040585D
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040586C
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 00405882
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D08,00000000,-0000000A,004093B0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004058C8
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004058DA
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004058E1
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 004058E8
                                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModuleMovePointerProcReadSizeWritewsprintf
                                                                                                                                                                                                        • String ID: %s=%s$[Rename]
                                                                                                                                                                                                        • API String ID: 3178728463-1727408572
                                                                                                                                                                                                        • Opcode ID: e9ce49729cb88f09fd70508b5b6f2b3f2c96f64563c3098240f57232e89c8bcc
                                                                                                                                                                                                        • Instruction ID: b4a0761097f53e27704103e00ee6cd595734002638f7a2c326e30edaa923f398
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e9ce49729cb88f09fd70508b5b6f2b3f2c96f64563c3098240f57232e89c8bcc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54410432A05B11BBE7206B619D49F6B3A6CEF44715F044436FD05F62D2E678A8018EBD
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405A65 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 195stringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 353 405a65-405a70 354 405a72-405a81 353->354 355 405a83-405aa0 353->355 354->355 356 405aa6-405aad 355->356 357 405c7e-405c82 355->357 356->357 358 405ab2-405abc 357->358 359 405c88-405c92 357->359 358->359 360 405ac2-405ac9 358->360 361 405c94-405c98 call 405a43 359->361 362 405c9d-405c9e 359->362 363 405c71 360->363 364 405acf-405b00 360->364 361->362 366 405c73-405c79 363->366 367 405c7b-405c7d 363->367 368 405b06-405b11 GetVersion 364->368 369 405c1b-405c1e 364->369 366->357 367->357 370 405b13-405b17 368->370 371 405b2b 368->371 372 405c20-405c23 369->372 373 405c4e-405c51 369->373 370->371 376 405b19-405b1d 370->376 379 405b32-405b39 371->379 377 405c33-405c3f call 405a43 372->377 378 405c25-405c31 call 4059a1 372->378 374 405c53-405c5a call 405a65 373->374 375 405c5f-405c6f lstrlenA 373->375 374->375 375->357 376->371 381 405b1f-405b23 376->381 390 405c44-405c4a 377->390 378->390 383 405b3b-405b3d 379->383 384 405b3e-405b40 379->384 381->371 386 405b25-405b29 381->386 383->384 388 405b42-405b65 call 40592a 384->388 389 405b79-405b7c 384->389 386->379 400 405c02-405c06 388->400 401 405b6b-405b74 call 405a65 388->401 391 405b8c-405b8f 389->391 392 405b7e-405b8a GetSystemDirectoryA 389->392 390->375 394 405c4c 390->394 398 405b91-405b9f GetWindowsDirectoryA 391->398 399 405bf9-405bfb 391->399 397 405bfd-405c00 392->397 396 405c13-405c19 call 405ca1 394->396 396->375 397->396 397->400 398->399 399->397 402 405ba1-405bab 399->402 400->396 405 405c08-405c0e lstrcatA 400->405 401->397 407 405bc5-405bdb SHGetSpecialFolderLocation 402->407 408 405bad-405bb0 402->408 405->396 411 405bf6 407->411 412 405bdd-405bf4 SHGetPathFromIDListA CoTaskMemFree 407->412 408->407 410 405bb2-405bb9 408->410 413 405bc1-405bc3 410->413 411->399 412->397 412->411 413->397 413->407
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetVersion.KERNEL32(?,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405B09
                                                                                                                                                                                                        • GetSystemDirectoryA.KERNEL32(zhuomian,00000400), ref: 00405B84
                                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(zhuomian,00000400), ref: 00405B97
                                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405BD3
                                                                                                                                                                                                        • SHGetPathFromIDListA.SHELL32(00000000,zhuomian), ref: 00405BE1
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00405BEC
                                                                                                                                                                                                        • lstrcatA.KERNEL32(zhuomian,\Microsoft\Internet Explorer\Quick Launch), ref: 00405C0E
                                                                                                                                                                                                        • lstrlenA.KERNEL32(zhuomian,?,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405C60
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$zhuomian
                                                                                                                                                                                                        • API String ID: 900638850-2103466657
                                                                                                                                                                                                        • Opcode ID: deb8cadcda4d035cdc64311d821c0dcc34042e8c40dbf8a3a3430eba01356339
                                                                                                                                                                                                        • Instruction ID: 9b1bf7279014b7c8101eb7e454522d29597b913ca5fabe9a72ab98517bc843d5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: deb8cadcda4d035cdc64311d821c0dcc34042e8c40dbf8a3a3430eba01356339
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 50512671A04A05AAEB205F68DC84B7F3B74EB11714F14023BE911B62E1D33C6982DF5E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401734 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 414 401734-401757 call 4029e8 call 4055a3 419 401761-401773 call 405a43 call 405536 lstrcatA 414->419 420 401759-40175f call 405a43 414->420 426 401778-40177e call 405ca1 419->426 420->426 430 401783-401787 426->430 431 401789-401793 call 405d3a 430->431 432 4017ba-4017bd 430->432 440 4017a5-4017b7 431->440 441 401795-4017a3 CompareFileTime 431->441 434 4017c5-4017e1 call 40571a 432->434 435 4017bf-4017c0 call 4056fb 432->435 442 4017e3-4017e6 434->442 443 401859-401882 call 404de1 call 402f01 434->443 435->434 440->432 441->440 444 4017e8-40182a call 405a43 * 2 call 405a65 call 405a43 call 405304 442->444 445 40183b-401845 call 404de1 442->445 457 401884-401888 443->457 458 40188a-401896 SetFileTime 443->458 444->430 479 401830-401831 444->479 455 40184e-401854 445->455 459 402886 455->459 457->458 461 40189c-4018a7 FindCloseChangeNotification 457->461 458->461 462 402888-40288c 459->462 464 40287d-402880 461->464 465 4018ad-4018b0 461->465 464->459 467 4018b2-4018c3 call 405a65 lstrcatA 465->467 468 4018c5-4018c8 call 405a65 465->468 473 4018cd-4021fb 467->473 468->473 477 402200-402205 473->477 478 4021fb call 405304 473->478 477->462 478->477 479->455 480 401833-401834 479->480 480->445
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrcatA.KERNEL32(00000000,00000000,00409408,C:\Users\user\AppData\Roaming\360wp\User Data,00000000,00000000,00000031), ref: 00401773
                                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,00409408,00409408,00000000,00000000,00409408,C:\Users\user\AppData\Roaming\360wp\User Data,00000000,00000000,00000031), ref: 0040179D
                                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa$C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\System.dll$C:\Users\user\AppData\Roaming\360wp\User Data$zhuomian
                                                                                                                                                                                                        • API String ID: 1941528284-3044392296
                                                                                                                                                                                                        • Opcode ID: 162a66a5d63f4167212c2692ab83d910656b2982ca0eaaed571ca35e1fd446d6
                                                                                                                                                                                                        • Instruction ID: 502ebc8251cf4d34670626f1a6973296816b4538e99af67961374f69fd5ad3b4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 162a66a5d63f4167212c2692ab83d910656b2982ca0eaaed571ca35e1fd446d6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B41E371A00514BACF10BBB9DD86DAF3A69EF45368B20433BF111B11E1D67C8B418E6D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 1000347F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105registrymemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 481 1000347f-1000348d 482 10003493-100034be call 10002f8e RegQueryValueExA 481->482 483 10003567-10003569 481->483 489 100034c4-100034c8 482->489 490 10003558-10003566 call 10002335 482->490 485 10003585-1000358e call 100022b7 483->485 486 1000356b-10003584 RegQueryValueExW 483->486 493 100034ca-100034ce 489->493 494 100034ef-100034f7 489->494 493->494 496 100034d0-100034d4 493->496 497 10003540-10003545 494->497 498 100034f9-10003509 GlobalAlloc 494->498 496->494 501 100034d6-100034ed RegQueryValueExA 496->501 499 10003547-1000354a 497->499 500 1000354c-1000354e 497->500 502 1000350b-1000352d RegQueryValueExA call 1000237c 498->502 503 1000353f 498->503 499->500 504 10003550-10003555 500->504 505 10003557 500->505 501->490 507 10003532-10003539 GlobalFree 502->507 503->497 504->505 505->490 507->503
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,IsUserActive,00000000), ref: 100034FF
                                                                                                                                                                                                        • RegQueryValueExA.KERNELBASE(00000001,?,?,?,00000000,?), ref: 1000351C
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10003539
                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00010000), ref: 1000357D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • \??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp, xrefs: 10003493
                                                                                                                                                                                                        • IsUserActive, xrefs: 100034F9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: QueryValue$Global$AllocFree
                                                                                                                                                                                                        • String ID: IsUserActive$\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 1034700490-2082603366
                                                                                                                                                                                                        • Opcode ID: 667577040a506b28336520f71bc1f51e19cf36d0fad04b464ea628e513f7ecfe
                                                                                                                                                                                                        • Instruction ID: 81d722525f6eb703a7675ca5f3ce6bcf65688ca7e786388ace9c35b78997f692
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 667577040a506b28336520f71bc1f51e19cf36d0fad04b464ea628e513f7ecfe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D31187290014AFFEF02CF94CC41AEF7BBAFF08284F108059FA15A6124D732AA60DB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402F01 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109fileCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 508 402f01-402f10 509 402f12-402f28 SetFilePointer 508->509 510 402f2e-402f39 call 40302c 508->510 509->510 513 403025-403029 510->513 514 402f3f-402f59 ReadFile 510->514 515 403022 514->515 516 402f5f-402f62 514->516 518 403024 515->518 516->515 517 402f68-402f7b call 40302c 516->517 517->513 521 402f81-402f84 517->521 518->513 522 402ff1-402ff7 521->522 523 402f86-402f89 521->523 524 402ff9 522->524 525 402ffc-40300f ReadFile 522->525 526 40301d-403020 523->526 527 402f8f 523->527 524->525 525->515 528 403011-40301a 525->528 526->513 529 402f94-402f9c 527->529 528->526 530 402fa1-402fb3 ReadFile 529->530 531 402f9e 529->531 530->515 532 402fb5-402fb8 530->532 531->530 532->515 533 402fba-402fcf WriteFile 532->533 534 402fd1-402fd4 533->534 535 402fed-402fef 533->535 534->535 536 402fd6-402fe9 534->536 535->518 536->529 537 402feb 536->537 537->526
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00409190,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190,?), ref: 00402F28
                                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000004,?,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190), ref: 00402F55
                                                                                                                                                                                                        • ReadFile.KERNEL32(004130A0,00004000,?,00000000,00409190,?,00402EAD,000000FF,00000000,00000000,00409190,?), ref: 00402FAF
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,004130A0,?,000000FF,00000000,?,00402EAD,000000FF,00000000,00000000,00409190,?), ref: 00402FC7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Read$PointerWrite
                                                                                                                                                                                                        • String ID: !9
                                                                                                                                                                                                        • API String ID: 2113905535-933955959
                                                                                                                                                                                                        • Opcode ID: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                                        • Instruction ID: f57f03ec19a78774be9adcd31849d1562aa90d9077fbbcd5e62cb2d9af4c63a1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D311A31901209EFDF21CF95DE44EAE7BBCEB44365F24403AF904A61E0D2749E40EB69
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040266E Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026C2
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026DE
                                                                                                                                                                                                        • GlobalFree.KERNELBASE(?), ref: 00402717
                                                                                                                                                                                                        • WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402729
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00402730
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402748
                                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040275C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$AllocFileFree$ChangeCloseDeleteFindNotificationWrite
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2326852265-0
                                                                                                                                                                                                        • Opcode ID: 32859fda9f92782a5a51194cda546ed71ef65f75f384b436084f0cd6aa7a6abf
                                                                                                                                                                                                        • Instruction ID: c44f166cf789c73980343851032ece5a06a24c9bd4eff2e899fc72ce2868172c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32859fda9f92782a5a51194cda546ed71ef65f75f384b436084f0cd6aa7a6abf
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79318D71C00128BBDF116FA5CE89D9E7E79EF09324F10422AF914762E0C7795D419BA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 1000358F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79registrymemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegSetValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000), ref: 100035D4
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00000000,10027780), ref: 100035E6
                                                                                                                                                                                                        • RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000000,00000000,10027780,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00010000), ref: 1000360E
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10003618
                                                                                                                                                                                                        • RegSetValueExW.ADVAPI32(?,10027780,00000000,?,00000000,00000000,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp), ref: 10003644
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • \??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp, xrefs: 100035A5
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$Global$AllocFree
                                                                                                                                                                                                        • String ID: \??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 2273869824-3755580367
                                                                                                                                                                                                        • Opcode ID: a445b501be8d8de309ca3c80ba5540f8b3ad5a8f85e0d323dc708c464a9c4908
                                                                                                                                                                                                        • Instruction ID: ae50ba5e7a2cc0507a585ab724dadc37df32a6046dc0e37f4cb27eab9507f8c4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a445b501be8d8de309ca3c80ba5540f8b3ad5a8f85e0d323dc708c464a9c4908
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0921F87650011AFFEF129F94DC4599F7FBAEF486D0B208014FA0592228DB329D61EBA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F2624F Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 592 2f2624f-2f26259 593 2f262c1-2f262c4 592->593 594 2f2625b-2f2626b 592->594 595 2f262c6-2f262cb 593->595 596 2f262e8-2f262f6 HeapDestroy 593->596 597 2f262ad-2f262bf HeapFree 594->597 598 2f2626d-2f26278 594->598 600 2f262cd-2f262d2 595->600 597->596 599 2f2627b-2f262ab VirtualFree * 2 HeapFree 598->599 599->597 599->599 601 2f262e2-2f262e6 600->601 602 2f262d4-2f262dc VirtualFree 600->602 601->596 601->600 602->601
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F26287
                                                                                                                                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F26292
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F2629F
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F262BB
                                                                                                                                                                                                        • VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,02F244F1,02F24545,?,?,?), ref: 02F262DC
                                                                                                                                                                                                        • HeapDestroy.KERNELBASE(?,?,02F244F1,02F24545,?,?,?), ref: 02F262EE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Free$HeapVirtual$Destroy
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 716807051-0
                                                                                                                                                                                                        • Opcode ID: 0aed761958227bd33185b0c33910078911695fb0112e494e7e025fb293f21acb
                                                                                                                                                                                                        • Instruction ID: a38a00cb6e29f0c661ac663bcd46962f662caa2d4f5932e8d7112ee4bb54853f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0aed761958227bd33185b0c33910078911695fb0112e494e7e025fb293f21acb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A1115A32E80219ABDA329F10EC85F16F7AAF7427D1F224825F741A7190C761B859CB14
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10004398 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 184registryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 603 10004398-10004411 call 10002cf0 call 10002b98 * 4 call 100023b4 call 10002625 618 10004417-10004445 call 10003393 603->618 619 1000458f 603->619 618->619 625 1000444b-1000444e 618->625 620 10004594-1000459f call 10002c7b 619->620 626 10004551-10004577 call 10001e51 call 1000358f 625->626 627 10004454-10004458 625->627 636 10004579 626->636 627->626 629 1000445e-10004461 627->629 629->626 631 10004467-1000446a 629->631 631->626 633 10004470-10004473 631->633 633->626 634 10004479-1000447c 633->634 634->626 637 10004482-10004485 634->637 638 1000457c-1000458d RegCloseKey 636->638 637->626 639 1000448b-1000448e 637->639 638->619 638->620 640 10004490-10004493 639->640 641 100044ff-1000450e call 10001a83 639->641 640->641 642 10004495-10004498 640->642 649 10004510-10004534 641->649 650 10004537-1000453d 641->650 644 100044d1-100044d4 642->644 645 1000449a-100044a1 642->645 651 100044d6-100044d9 644->651 652 100044df-100044fd call 1000188c call 1000358f 644->652 647 100044a3-100044aa 645->647 648 100044bb 645->648 653 100044ac 647->653 654 100044af-100044b7 647->654 656 100044be-100044cf 648->656 649->650 655 1000453e-10004547 call 1000358f 650->655 651->638 651->652 652->636 653->654 654->647 659 100044b9 654->659 662 1000454c-1000454f 655->662 656->655 659->656 662->636
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                                          • Part of subcall function 10003393: RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(00000000), ref: 1000457F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharCloseCreateFreeGlobalMultiWide
                                                                                                                                                                                                        • String ID: IsUserActive$REG_DWORD$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 4251543773-573575443
                                                                                                                                                                                                        • Opcode ID: 160d70910c7556d6efce1072150f5861b7855c0f9ede8537b5eb1b8d8e125472
                                                                                                                                                                                                        • Instruction ID: b4c99bf703c6d4f3faf4f10a0c974bb97cee2be09989649d504a6fe7688cbc7d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 160d70910c7556d6efce1072150f5861b7855c0f9ede8537b5eb1b8d8e125472
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A951E7F2E00504BBFB11DA64CC85EBF3AADEB853D1F124029F615A316ADF349E41C665
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040302C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 664 40302c-403055 GetTickCount 665 403196-40319e call 402bc5 664->665 666 40305b-403086 call 4031da SetFilePointer 664->666 671 4031a0-4031a5 665->671 672 40308b-40309d 666->672 673 4030a1-4030af call 4031a8 672->673 674 40309f 672->674 677 4030b5-4030c1 673->677 678 403188-40318b 673->678 674->673 679 4030c7-4030cd 677->679 678->671 680 4030f8-403114 call 405e5b 679->680 681 4030cf-4030d5 679->681 687 403191 680->687 688 403116-40311e 680->688 681->680 682 4030d7-4030f7 call 402bc5 681->682 682->680 689 403193-403194 687->689 690 403120-403136 WriteFile 688->690 691 403152-403158 688->691 689->671 693 403138-40313c 690->693 694 40318d-40318f 690->694 691->687 692 40315a-40315c 691->692 692->687 696 40315e-403171 692->696 693->694 695 40313e-40314a 693->695 694->689 695->679 697 403150 695->697 696->672 698 403177-403186 SetFilePointer 696->698 697->696 698->665
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00403041
                                                                                                                                                                                                          • Part of subcall function 004031DA: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,?), ref: 004031E8
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403074
                                                                                                                                                                                                        • WriteFile.KERNEL32(0040B0A0,0040C085,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 0040312E
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(003921ED,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 00403180
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Pointer$CountTickWrite
                                                                                                                                                                                                        • String ID: !9
                                                                                                                                                                                                        • API String ID: 2146148272-933955959
                                                                                                                                                                                                        • Opcode ID: 32b7c15da88a2ccc78eb3c9a966b00937d482487994a3c8693a9c70e9024f3ed
                                                                                                                                                                                                        • Instruction ID: b900033f33315bf13e96bf0933fc3f5ca139b675e2fdc73b2e3f7a71e75fad19
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32b7c15da88a2ccc78eb3c9a966b00937d482487994a3c8693a9c70e9024f3ed
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1641AE72505205AFC720DF18EE8496B3FBCF748356B01463FE520BA2E0D7386A459BAD
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004022F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 699 4022f5-40233b call 402add call 4029e8 * 2 RegCreateKeyExA 706 402341-402349 699->706 707 40287d-40288c 699->707 709 402359-40235c 706->709 710 40234b-402358 call 4029e8 lstrlenA 706->710 713 40236c-40236f 709->713 714 40235e-40236b call 4029cb 709->714 710->709 717 402380-402394 RegSetValueExA 713->717 718 402371-40237b call 402f01 713->718 714->713 719 402396 717->719 720 402399-402475 RegCloseKey 717->720 718->717 719->720 720->707
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402333
                                                                                                                                                                                                        • lstrlenA.KERNEL32(zhuomian,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402353
                                                                                                                                                                                                        • RegSetValueExA.KERNEL32(?,?,?,?,zhuomian,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238C
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,zhuomian,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCreateValuelstrlen
                                                                                                                                                                                                        • String ID: zhuomian
                                                                                                                                                                                                        • API String ID: 1356686001-4173391253
                                                                                                                                                                                                        • Opcode ID: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                                        • Instruction ID: a02971d7ffc86f6f7c629cb7da59e84f0146b185ae6196f13f615d438ff22468
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B1172B1E00108BFEB10AFA5DE8AEAF767CEB40748F10443AF505B71D1D7B99D019A68
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        • LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00401FF9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • 08bcc5cf9e3fc589107741a5e999ecfa, xrefs: 00401FD1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa
                                                                                                                                                                                                        • API String ID: 2987980305-3684857273
                                                                                                                                                                                                        • Opcode ID: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                                        • Instruction ID: 0a17743dc10516c1e404603622caa6e4d13095454b29418bb929f5860ba01445
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4611D872D04115A7CF107FA4DE85EAE75B0AB44359F204237F611B62E0C77C4941965E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 004055D8
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
                                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\360wp\User Data,00000000,00000000,000000F0), ref: 00401622
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360wp\User Data, xrefs: 00401617
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360wp\User Data
                                                                                                                                                                                                        • API String ID: 3751793516-1006468001
                                                                                                                                                                                                        • Opcode ID: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                                        • Instruction ID: 6d25d20538d6d8534b6823f3fc6f17b8a3ed29de71c0eeeb3a5295b4bc58004c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B6010431908150ABDB116FB55D44D7F6BB0EA52365728063FF491B22E2C23C8942D62E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405749 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 0040575C
                                                                                                                                                                                                        • GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405776
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • nsa, xrefs: 00405755
                                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian, xrefs: 00405750
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405749, 0040574C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                        • API String ID: 1716503409-2721064756
                                                                                                                                                                                                        • Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                                        • Instruction ID: 034d2fd5f9dd90bdc64dfe9fa05123f4a2a2f766a0f29b75e345e617da869bcc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9CF0A736348204BADB104F55DC04B9B7F59DF91750F14C027FE449B1C0D6B1995897A5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402A28 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(?,?,00000000,?,?), ref: 00402A49
                                                                                                                                                                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A85
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402A8E
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402AB3
                                                                                                                                                                                                        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AD1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1912718029-0
                                                                                                                                                                                                        • Opcode ID: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                                        • Instruction ID: 092ce5dc9ace931e83acbc3e972042597453fb0194ad27f06f99c48de557c256
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C118971A00009FFDF21AF90DE48DAB7B39EB44384B004076BA01A01A0DB749E41EE69
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F22F10 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Valuelstrcmpi
                                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                                        • API String ID: 1914577711-2395435937
                                                                                                                                                                                                        • Opcode ID: d8d7941c1ff2b72dc459b33a7c48a234c08986276503d86a255ba0ae2de724b2
                                                                                                                                                                                                        • Instruction ID: 165c92e86dbb7b825dd1ff856dd71aa5e68366ec77ea31fea5e125a0f761eb80
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d8d7941c1ff2b72dc459b33a7c48a234c08986276503d86a255ba0ae2de724b2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33415B72E083558BE735C928D800BFB77D0EBC2B94F44496DEA85C7194EF3A950D87A2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100042B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?), ref: 10004344
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
                                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 3735805505-481102535
                                                                                                                                                                                                        • Opcode ID: ae8d182f79f2bfc1a7be0f87d09a4fce654424f02b224733c4aaf5a4d82723ba
                                                                                                                                                                                                        • Instruction ID: da14d6f09df9c476e187c7044975134286627e28dc9b3e8c64bc06710fbf7309
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae8d182f79f2bfc1a7be0f87d09a4fce654424f02b224733c4aaf5a4d82723ba
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C821ACB6C00208BBFF11DF958C85DDFBBBDEF05290F6040A6FA14A2115D7359E049BA4
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10003393 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                                        • RegCreateKeyExW.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,?,10004440,00000000,Software\360WallPaper,00000000,00000000,00000000), ref: 1000340C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Create$FreeGlobal
                                                                                                                                                                                                        • String ID: Software\360WallPaper
                                                                                                                                                                                                        • API String ID: 1366836192-3217021507
                                                                                                                                                                                                        • Opcode ID: e8f8f166a8ed0e7c69ad6b0f2b36b80f7a6e9b7f677287450aa0db076d234df0
                                                                                                                                                                                                        • Instruction ID: aa56ff811675d69e7919beffeeb5fe803cdf6dd7f71a7261d828bb87f28b6d50
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8f8f166a8ed0e7c69ad6b0f2b36b80f7a6e9b7f677287450aa0db076d234df0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB11053200414ABFEF029F90EC45CEA3FAAFF4D2A4B114125FA0891124DB36E971AB90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 004055D8
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 0040566A
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 0040567A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                                        • API String ID: 3248276644-3404278061
                                                                                                                                                                                                        • Opcode ID: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                                        • Instruction ID: 163ab709c3a69a1d20cf6f8253de986ede20969e143c641b36a5b73ea23f62c0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F9F0F911205D5025C72222351C09AAF0A55CD623287990E3FF858B12D1CA3D8943DC6D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 1000341E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.KERNELBASE(00020019,00000000,-00000008,?,10003BDF,10027780,REG_DWORD,?,100038CF,00020019,00000000,-00000008,?,10003BDF,00000000,10003BDF), ref: 10003445
                                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(00020019,00000000,-00000008,?,10003BDF,?,100038CF,00020019,00000000,-00000008,?,10003BDF,00000000,10003BDF,?,-00000008), ref: 1000346D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Open$FreeGlobal
                                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                                        • API String ID: 355097715-3740793138
                                                                                                                                                                                                        • Opcode ID: 07b7dc59b8ece281ad733227d2b9121c370f1dbd4f21f9b302e7c3dc98f75a48
                                                                                                                                                                                                        • Instruction ID: 377d775a3d59cacce431edfbf9d8faf3fc6213752c062a16a90a449e4ddf95ac
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 07b7dc59b8ece281ad733227d2b9121c370f1dbd4f21f9b302e7c3dc98f75a48
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A2F01D3650015ABBEF029FA5EC058DB3F6AFF892E1B108021FA0C85124D732D9719B90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004031F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00403212
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Char$Next$CreateDirectoryPrev
                                                                                                                                                                                                        • String ID: 2052$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                        • API String ID: 4115351271-2330795339
                                                                                                                                                                                                        • Opcode ID: 178f3fee0fe42fa6237002c0f83b77f0329cc0a1a68c82cc1b81573e38bf9039
                                                                                                                                                                                                        • Instruction ID: 8509fc719cfacdd3e0f19311c8db3474c91ee7b64774067ccbe91e129429c82f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 178f3fee0fe42fa6237002c0f83b77f0329cc0a1a68c82cc1b81573e38bf9039
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75D0A92160AD3036CA613B273C0AFCF090C8F0232DF2500BBF804B00C68B6C5A8218EF
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040643F Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                                        • Instruction ID: 46f5cb6b99077c8a932221f6f95319a4d003604abf7c8fe4deea8dd62122f91f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1EA13371D00229CBEF28CFA8C8547ADBBB1FF44309F15856AD816BB281D7785A86DF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00406640 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                                        • Instruction ID: b6d6ccc853a16e4f483ba8b04077c6698ffe39116f32d6ac079e48ce0b9a1d5b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C912071D00229CBEF28CF98C844BADBBB1FF44305F15816AD816BB291D7789A86DF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00406356 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                                        • Instruction ID: 9f2062d8dd3c72469bab0aaa0c4d472ca99449d25692711e554c959146fb5a05
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F812471D00229CFEF24CFA9C8447AEBBB1FB44305F25816AD816BB281C7789985DF55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405E5B Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                                        • Instruction ID: 84f98c36384fe8ee64262c0bd4aeca6ab0d9deaaf6f503267966aff3759d9c01
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB816672D04229CBEF24CFA9C8447AEBBB0FF44305F25816AD856B7281C7785A86DF54
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004062A9 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                                        • Instruction ID: 87842c1f76f394e9967038b09935c6923b6a3569bddc7a9db877803d8644aafd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE711171D00229CFEF28CF98C844BADBBB1FB48305F15806AD816B7281D7789996DF54
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004063C7 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                                        • Instruction ID: f29c7650ca7732be42b715054819f9ef2f9a8d26a50ddb16a6e1c9f426a403c7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6712271E00229CBEF28CF99C844BAEBBB1FB44305F15806AD816B7281C7789996DF55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00406313 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                                        • Instruction ID: 150ce1bc09a2c7df66eb9a1793004520446428f7a11f196e4037732027db8909
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31712371D00229CBEF28CF98C844BAEBBB1FF44305F15806AD816B7291C7789A96DF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040592A Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(80000002,00405B62,00000000,00000002,?,00000002,?,?,00405B62,80000002,Software\Microsoft\Windows\CurrentVersion,?,zhuomian,?), ref: 00405953
                                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(?,?,00000000,00405B62,?,00405B62), ref: 00405974
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00405995
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                        • Opcode ID: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
                                                                                                                                                                                                        • Instruction ID: 36589d6fa93a219f8bc047707fd62eb4045adffcbf025e375e54fe90c3c214b0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 100148B104020AEFDB128F65EC44AEB7FACEF143A4F004426FD44A6160D235D964DFA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405D61 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 310444273-0
                                                                                                                                                                                                        • Opcode ID: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                                        • Instruction ID: 632a00fb12e3cb8d7b800c8c05c00ea1272b68564f45bf1eadf202890d1355d3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AE08C32A04611ABC7115B20AD0897B73A8EED9B41304493EF909F6290D734AC11ABBA
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004035A6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035B8
                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035CC
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\, xrefs: 004035D7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\
                                                                                                                                                                                                        • API String ID: 2962429428-2471566891
                                                                                                                                                                                                        • Opcode ID: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                                        • Instruction ID: f9564199049be1f32d817ae5fae54506e28515e34a5cdd4db7d8b8eaa5d9f10b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE0C230904A10A6C630AF3CBE499063A6C6B413317244B26F174F21F1C778AE428AA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100048B1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10003393: RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 1000491F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCreateFreeGlobal
                                                                                                                                                                                                        • String ID: Software\360WallPaper
                                                                                                                                                                                                        • API String ID: 2564295761-3217021507
                                                                                                                                                                                                        • Opcode ID: b91314f91aa304db9247177ad946028b29e8f64a40d817af18a68822f9e79358
                                                                                                                                                                                                        • Instruction ID: 605d8d1225a9b23038807ad8a28179a2e71f871007bc0d5f9e86542fed4c56d6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b91314f91aa304db9247177ad946028b29e8f64a40d817af18a68822f9e79358
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70118076900108BBEB11DF86CD45CDF7FBDEF8A390F100065FA04A212ADB319A15DBA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004023A1 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(00000000,00000000,?,000003FF,?,?,?,?,00000033), ref: 004023D1
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,zhuomian,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                        • Opcode ID: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                                        • Instruction ID: 761649a6a3df08df281199264971948c500f78b60f5aa5b2cb2b090958000ad5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 85118271A05205EFDB15CFA4CA4C9AE7BB4EF10354F20807FE441B72C0D6B88A45EB26
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F2442C Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetVersion.KERNEL32(02F24545,?,?,?), ref: 02F24439
                                                                                                                                                                                                          • Part of subcall function 02F261F2: HeapCreate.KERNEL32(00000000,00001000,00000000,02F2444B,00000001), ref: 02F26203
                                                                                                                                                                                                          • Part of subcall function 02F261F2: HeapDestroy.KERNEL32 ref: 02F26242
                                                                                                                                                                                                          • Part of subcall function 02F2757C: TlsAlloc.KERNEL32(?,02F24483), ref: 02F27582
                                                                                                                                                                                                          • Part of subcall function 02F2757C: TlsSetValue.KERNEL32(00000000), ref: 02F275AA
                                                                                                                                                                                                          • Part of subcall function 02F2757C: GetCurrentThreadId.KERNEL32 ref: 02F275BB
                                                                                                                                                                                                        • GetCommandLineA.KERNEL32 ref: 02F24490
                                                                                                                                                                                                          • Part of subcall function 02F2624F: VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F26287
                                                                                                                                                                                                          • Part of subcall function 02F2624F: VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F26292
                                                                                                                                                                                                          • Part of subcall function 02F2624F: HeapFree.KERNEL32(00000000,?,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F2629F
                                                                                                                                                                                                          • Part of subcall function 02F2624F: HeapFree.KERNEL32(00000000,?,?,?,?,02F244F1,02F24545,?,?,?), ref: 02F262BB
                                                                                                                                                                                                          • Part of subcall function 02F2624F: HeapDestroy.KERNELBASE(?,?,02F244F1,02F24545,?,?,?), ref: 02F262EE
                                                                                                                                                                                                          • Part of subcall function 02F27668: TlsGetValue.KERNEL32(FFFFFFFF,?,02F244FE,00000000,02F24545,?,?,?), ref: 02F27680
                                                                                                                                                                                                          • Part of subcall function 02F27668: TlsSetValue.KERNEL32(00000000,?,02F244FE,00000000,02F24545,?,?,?), ref: 02F27700
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Heap$Free$Value$DestroyVirtual$AllocCommandCreateCurrentLineThreadVersion
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1348591257-0
                                                                                                                                                                                                        • Opcode ID: 2a36bc55e1ba924512e53a5d74ac9ebc93b1b5ebfaa6ca5024ecde931a6aae4f
                                                                                                                                                                                                        • Instruction ID: cbd8e21c9977a1dd2e9ca52fb163999cf89d471d9262c2cb26c95455de3956a4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a36bc55e1ba924512e53a5d74ac9ebc93b1b5ebfaa6ca5024ecde931a6aae4f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A0115471D8923E8FDB18FBB0AE41A19F657EB473C17110C6ADB01C5240DBB48568CF91
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                        • Opcode ID: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                                        • Instruction ID: d0f03140fbd629d0c0bf1accbe8acf671ec28544698acb2ee9a16026c0f47d2e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F01F431B24210ABE7295B389D04B2A36ADE710315F10423BF855F66F1D67CDC028B4D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402299 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                                        • RegDeleteValueA.KERNEL32(00000000,00000000,00000033), ref: 004022B8
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 004022C1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseDeleteOpenValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 849931509-0
                                                                                                                                                                                                        • Opcode ID: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                                        • Instruction ID: c96301186d0cc23108267263ea3d95e678ff255433b24e802bfd10008ffd0a7a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7F06273B00110ABDB20BBE59F4EAAE6268AB40355F10453FF101B71D1DAFD8D41976E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F261F2 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapCreate.KERNEL32(00000000,00001000,00000000,02F2444B,00000001), ref: 02F26203
                                                                                                                                                                                                          • Part of subcall function 02F260AA: GetVersionExA.KERNEL32 ref: 02F260C9
                                                                                                                                                                                                        • HeapDestroy.KERNEL32 ref: 02F26242
                                                                                                                                                                                                          • Part of subcall function 02F262F7: HeapAlloc.KERNEL32(00000000,00000140,02F2622B,000003F8), ref: 02F26304
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Heap$AllocCreateDestroyVersion
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2507506473-0
                                                                                                                                                                                                        • Opcode ID: 6be5301de2915bbcb005f47e0e450ec315d8fb9cba38383556ce9d7a1b98eeb7
                                                                                                                                                                                                        • Instruction ID: 00fb64603ba093b0a1c4415fc604a210d56cec99c892d9dab56b8b7eec8fd490
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6be5301de2915bbcb005f47e0e450ec315d8fb9cba38383556ce9d7a1b98eeb7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 61F06D71E903169BDF20AB30AC0572A7BDAAB47BC2F104826E701C91D4EBA4C4A89901
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040571A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                                        • Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                                        • Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(?,00405506,?,?,?), ref: 004056FF
                                                                                                                                                                                                        • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405711
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                        • Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                                        • Instruction ID: 1a0f39e157c28011d0f8c1384ae394ffa0e61bdf00c6ebf87dc07efa44195b5a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 16C04CB1818506ABD6056B24DF0D81F7B66EF90321B108B35F569E00F0C7355C66EE1A
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401B06 Relevance: 2.6, APIs: 2, Instructions: 72memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GlobalFree.KERNEL32(005161D0), ref: 00401B75
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401B87
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$AllocFree
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3394109436-0
                                                                                                                                                                                                        • Opcode ID: 7c171d38e55c0da398560173357857eab17de6338ff8b470059d307903f45737
                                                                                                                                                                                                        • Instruction ID: 474fb9bf02499c7a6170e06d53d4e3f45d0768bb224d9c97df738da83c32a5d1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c171d38e55c0da398560173357857eab17de6338ff8b470059d307903f45737
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C8219376A04500ABCB10EBA49EC5E5F73A8EB84318B24853BF211B72D1D778E9418F5D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F23EE5 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,?,?,?,02F32E77), ref: 02F23FCC
                                                                                                                                                                                                          • Part of subcall function 02F2556E: InitializeCriticalSection.KERNEL32(00000000,?,00000010,?,02F23F7E,00000009,?,?,02F32E77), ref: 02F255AB
                                                                                                                                                                                                          • Part of subcall function 02F2556E: EnterCriticalSection.KERNEL32(00000010,00000010,?,02F23F7E,00000009,?,?,02F32E77), ref: 02F255C6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSection$AllocateEnterHeapInitialize
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1616793339-0
                                                                                                                                                                                                        • Opcode ID: bdf82ce17322b12b2e34f63a8841a0f046dc6dbce2a4dddaf03ff74ee6bc9f9e
                                                                                                                                                                                                        • Instruction ID: e65241ed7cc5b26b721a1950792ebbae890369a2fe809e8d918cdcdeb739ad38
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bdf82ce17322b12b2e34f63a8841a0f046dc6dbce2a4dddaf03ff74ee6bc9f9e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B2127B2F40228ABDB14DF64EC01B9EF7B5EB02BA4F104555F624EB2C0C378D9498B90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402AF2 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                                        • Opcode ID: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                                        • Instruction ID: 62d85545fb8c015d315058fdcb0d0d57892fb31d87e90ba3457693cc688901e8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46E086B6240108BFDB00DFA4ED47F9577ECF704301F004421B608D70A2C774E5408B58
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004031A8 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000000,00000000,00000000,004130A0,0040B0A0,004030AD,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000), ref: 004031BF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                                        • Opcode ID: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                                        • Instruction ID: b8f1ad64850fa721b7c3123cc302f733781f6218d307da9d2aa6486ecc23217a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4BE08632254119BBCF105E619C00AD73F5CEB0A3A2F008432FD55E9190D230EA11DBA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F275D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 02F25502: DeleteCriticalSection.KERNEL32(00000000,?,?,02F275D5,02F244EC,02F24545,?,?,?), ref: 02F25536
                                                                                                                                                                                                          • Part of subcall function 02F25502: DeleteCriticalSection.KERNEL32(?,?,02F275D5,02F244EC,02F24545,?,?,?), ref: 02F25551
                                                                                                                                                                                                          • Part of subcall function 02F25502: DeleteCriticalSection.KERNEL32 ref: 02F25559
                                                                                                                                                                                                          • Part of subcall function 02F25502: DeleteCriticalSection.KERNEL32 ref: 02F25561
                                                                                                                                                                                                          • Part of subcall function 02F25502: DeleteCriticalSection.KERNEL32 ref: 02F25569
                                                                                                                                                                                                        • TlsFree.KERNEL32(FFFFFFFF,02F244EC,02F24545,?,?,?), ref: 02F275E0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalDeleteSection$Free
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1584690612-0
                                                                                                                                                                                                        • Opcode ID: 67edcf30b44e7e774898e297b34b20adda89decd9f886b77fbde0f972b205112
                                                                                                                                                                                                        • Instruction ID: 4657e7872ae9c6efd77b4d32fef50e0eff399094caad27e8debb838c0a7545b6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 67edcf30b44e7e774898e297b34b20adda89decd9f886b77fbde0f972b205112
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 48C04C72C4465847D5646738984B419B66A76063F53E44F00E5B7C12E0E734846A8A00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004031DA Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,?), ref: 004031E8
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                        • Opcode ID: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                                        • Instruction ID: 0cdacc43d416a0c3c320ce55ce8d4373a9ea66752a7e2c64ddc4eeaf6ba3fa4d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 49B01271644200BFDA214F00DF05F057B31B790700F108430B394380F082712420EB0D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 00404730 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404747
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404754
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 004047A0
                                                                                                                                                                                                        • LoadBitmapA.USER32(0000006E), ref: 004047B3
                                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000FC,00404D31), ref: 004047CD
                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047E1
                                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004047F5
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 0040480A
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404816
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404828
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0040482D
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404858
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404864
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 004048F9
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404924
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404938
                                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404967
                                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404975
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404986
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A89
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404AEE
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404B03
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404B27
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B4D
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00404B62
                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00404B72
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404BE2
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C8B
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C9A
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404CBA
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00404D08
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404D13
                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00404D1A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                        • String ID: $M$N
                                                                                                                                                                                                        • API String ID: 1638840714-813528018
                                                                                                                                                                                                        • Opcode ID: bc9dc24ba24aefd25b5204966072fec4a33e7f324add771e9c8dcad7f4caa963
                                                                                                                                                                                                        • Instruction ID: 2f002745dd727b88aea6b3014e5fe59d6d497abb36422f7ee26b5b217c9fe0ee
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bc9dc24ba24aefd25b5204966072fec4a33e7f324add771e9c8dcad7f4caa963
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83028BB0A40209EFDB24DF64DD45AAE7BB5FB84315F10813AF610BA2E1C7799A41CF58
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F23560 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 217stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 02F235E7
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000001), ref: 02F2360D
                                                                                                                                                                                                        • WinVerifyTrust.WINTRUST(000000FF,00AAC56B,?,?,00000001), ref: 02F23657
                                                                                                                                                                                                        • WTHelperProvDataFromStateData.WINTRUST(?,000000FF,00AAC56B,?,?,00000001), ref: 02F2366B
                                                                                                                                                                                                        • WTHelperGetProvSignerFromChain.WINTRUST(00000000,00000000,00000000,00000000,?,000000FF,00AAC56B,?,?,00000001), ref: 02F23678
                                                                                                                                                                                                        • WTHelperGetProvCertFromChain.WINTRUST(00000000,00000000,00000000,00000000,00000000,00000000,?,000000FF,00AAC56B,?,?,00000001), ref: 02F23685
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FromHelperProv$ChainData$ByteCertCharMultiSignerStateTrustVerifyWidelstrlen
                                                                                                                                                                                                        • String ID: ,$A0$O$O
                                                                                                                                                                                                        • API String ID: 3359820040-3593575299
                                                                                                                                                                                                        • Opcode ID: 317fade06e8cf6b2ad39a6625eaafe04d5f36b237b8acbdbd2dfeccfc7868574
                                                                                                                                                                                                        • Instruction ID: 8c08e9268e3b4146e2e932208dae63d38296e53e32b43a028f2406d0d77e1002
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 317fade06e8cf6b2ad39a6625eaafe04d5f36b237b8acbdbd2dfeccfc7868574
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1081C5B1D0025DABDB20DFA8CC44BDEBFB9EF86760F144259E515AB380D7748A09CB91
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F23230 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82memoryfileencryptionCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,02F32E7C,02F32E78,02F2382C,?,?,?,?,?), ref: 02F23246
                                                                                                                                                                                                        • LocalAlloc.KERNEL32(00000040,00000064,02F32E78,?,00000000,?,?,?,?,?,02F32E78,02F2105F,?), ref: 02F2326E
                                                                                                                                                                                                        • CryptCATAdminCalcHashFromFileHandle.WINTRUST(?,?,00000000,00000000,?,?,?,?,?,02F32E78,02F2105F,?), ref: 02F23289
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,02F32E78,02F2105F,?), ref: 02F23292
                                                                                                                                                                                                        • LocalFree.KERNEL32(00000000,?,?,?,?,?,02F32E78,02F2105F,?), ref: 02F232A4
                                                                                                                                                                                                        • LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,02F32E78,02F2105F,?), ref: 02F232B2
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,02F32E78,02F2105F,?), ref: 02F232CE
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Local$AllocFileHandle$AdminCalcCloseCreateCryptErrorFreeFromHashLast
                                                                                                                                                                                                        • String ID: d
                                                                                                                                                                                                        • API String ID: 1027636831-2564639436
                                                                                                                                                                                                        • Opcode ID: e690d4289c744596b1fdc78ba5d6df5400508f6f158b1691e9a067cc5d8427ab
                                                                                                                                                                                                        • Instruction ID: 7348b1712d540a33587b915f30c0064e526062c6ce9529481a0d9fcc172ba280
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e690d4289c744596b1fdc78ba5d6df5400508f6f158b1691e9a067cc5d8427ab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B921AFB2A453619BD320CF64D844F1BB7A9EB8AB90F214959F7049B2C0CB78D809C7A1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F21F40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 02F21F97
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 02F21FD4
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 02F21FDF
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 02F220BD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandle$ControlCreateDeviceFile
                                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                        • API String ID: 1755752497-2935326385
                                                                                                                                                                                                        • Opcode ID: 724babbeeedb2d3a90ec1a9425445bfdcae21e66bb6c60f208ddab8cff4ee1e9
                                                                                                                                                                                                        • Instruction ID: bfd0e54eee984cd5e69135a29b30cfa2ac45b5a984b63dd4ee8608f5d54b4c03
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 724babbeeedb2d3a90ec1a9425445bfdcae21e66bb6c60f208ddab8cff4ee1e9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA414D316043546FE730CE24CC40BABB3D5EB92B95F00481CFB4597281DB75990EC752
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F22480 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,?,?,?), ref: 02F224C2
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 02F22505
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 02F22540
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 02F225CD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ControlDevice$CloseCreateFileHandle
                                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                        • API String ID: 1375849437-2935326385
                                                                                                                                                                                                        • Opcode ID: 1cdef67586afd33e026436b65b2317153d93f35078e44504c91d998bb2eb0c9d
                                                                                                                                                                                                        • Instruction ID: c58325b22c5c0fc6479b2ee09590ceff9a723fce375c509ad144f01ccf1a3ae3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1cdef67586afd33e026436b65b2317153d93f35078e44504c91d998bb2eb0c9d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AA412A71A443106BE330DE589C52F5BB7D9EF86B94F00491CFB856B2C0D7B5A50D8BA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F22300 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,02F22B7B,?,00000064), ref: 02F2235D
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 02F223B8
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 02F22436
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                        • API String ID: 33631002-2935326385
                                                                                                                                                                                                        • Opcode ID: 9b156c9894a3bc86205f99dc3e6a7f7594874394517ebb27d843d9a7e275dcb3
                                                                                                                                                                                                        • Instruction ID: 57de050c001d6ea0d29d7a8d362166ee7a09ebee718ec924657bb398dbac5d73
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9b156c9894a3bc86205f99dc3e6a7f7594874394517ebb27d843d9a7e275dcb3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9141E6715043549BE331CF14C880EABB7E5FBCA394F400D2DFA9493151DB74994D8B62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F237D0 Relevance: 6.1, APIs: 4, Instructions: 73encryptionCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CryptCATAdminAcquireContext.WINTRUST(02F32E7C,00000000,00000000,?,?,?,02F32E78,02F2105F,?), ref: 02F237E5
                                                                                                                                                                                                        • CryptCATAdminEnumCatalogFromHash.WINTRUST(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,02F32E78,02F2105F,?), ref: 02F2383F
                                                                                                                                                                                                        • CryptCATAdminReleaseCatalogContext.WINTRUST(?,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,?), ref: 02F23853
                                                                                                                                                                                                        • LocalFree.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,02F32E78,02F2105F), ref: 02F2385D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AdminCrypt$CatalogContext$AcquireEnumFreeFromHashLocalRelease
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4198237086-0
                                                                                                                                                                                                        • Opcode ID: 7de5da7a725ca6ab26312fb31344f8c6176860d586c0b0b1801de69e17e9f6cd
                                                                                                                                                                                                        • Instruction ID: e8b693641aef6ed14f1998e48fd7c51e45a15774475ebc1e26db5ba25dec8162
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7de5da7a725ca6ab26312fb31344f8c6176860d586c0b0b1801de69e17e9f6cd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 301182F27042166BE624DA59DC80FB7F39DEF867A4F10442EFA41C6140DB65E8098B70
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F23210 Relevance: 1.5, APIs: 1, Instructions: 8encryptionCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CryptCATAdminReleaseContext.WINTRUST(?,00000000), ref: 02F23220
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AdminContextCryptRelease
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3084080992-0
                                                                                                                                                                                                        • Opcode ID: ddf72af717de7f7a398f2c2ab6ca1547edc49fd089a6651ba00e94f329178127
                                                                                                                                                                                                        • Instruction ID: 7766e863b529b6f044fd557f331d15d2ff8fa0b6fc264f9c3cc436b352a0164d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ddf72af717de7f7a398f2c2ab6ca1547edc49fd089a6651ba00e94f329178127
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D7B092B430226066EB385B208E21B67775AAF43788FB8C4DC5209290C0C63AD00A8A80
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404F1F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278windowclipboardmemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 00404F7E
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00404F8D
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00404FCA
                                                                                                                                                                                                        • GetSystemMetrics.USER32(00000015), ref: 00404FD2
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404FF3
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405004
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405017
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405025
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405038
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040505A
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040506E
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040508F
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040509F
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004050B8
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004050C4
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 00404F9C
                                                                                                                                                                                                          • Part of subcall function 00403E6C: SendMessageA.USER32(00000028,?,00000001,00403C9D), ref: 00403E7A
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004050E1
                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00004EB3,00000000), ref: 004050EF
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004050F6
                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040511A
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040511F
                                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 00405166
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405198
                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004051A9
                                                                                                                                                                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004051BE
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 004051D1
                                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004051F5
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405230
                                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 00405240
                                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405246
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 0040524F
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405259
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040526D
                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405285
                                                                                                                                                                                                        • SetClipboardData.USER32(00000001,00000000), ref: 00405290
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 00405296
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                        • String ID: {
                                                                                                                                                                                                        • API String ID: 590372296-366298937
                                                                                                                                                                                                        • Opcode ID: 8ecacec262ee9c946a5dc1a8a4639b1463e14c3919ca1e3b64bff360b0e0cb3d
                                                                                                                                                                                                        • Instruction ID: 54a7b5396bae693a6587d4a30afce820365ed4185083f78a013f57a3a1aa2e37
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8ecacec262ee9c946a5dc1a8a4639b1463e14c3919ca1e3b64bff360b0e0cb3d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FDA14A70900208BFDB219F60DD89AAE7F79FB04355F00417AFA05BA2A0C7795E519F99
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403964 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039A0
                                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 004039BD
                                                                                                                                                                                                        • DestroyWindow.USER32 ref: 004039D1
                                                                                                                                                                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 004039ED
                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403A0E
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A22
                                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403A29
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403AD7
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403AE1
                                                                                                                                                                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403AFB
                                                                                                                                                                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B4C
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403BF2
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00403C13
                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C25
                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C40
                                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C56
                                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00403C5D
                                                                                                                                                                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C75
                                                                                                                                                                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C88
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,?,00420500,00423700), ref: 00403CB1
                                                                                                                                                                                                        • SetWindowTextA.USER32(?,00420500), ref: 00403CC0
                                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 00403DF4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 184305955-0
                                                                                                                                                                                                        • Opcode ID: 521e42e78b2c92cd1229cf199b8c668d2aaf7e2ddad680e485230a55364f8aca
                                                                                                                                                                                                        • Instruction ID: 7ba81dbe19c60a8e0c3243ea337059b00a2b0f070469454242f3f43eb6e2cd92
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 521e42e78b2c92cd1229cf199b8c668d2aaf7e2ddad680e485230a55364f8aca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36C1A271A04204BBD7206F61ED49E2B7EBCEB45706F40053EF541B12E1C779AA429F6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403F7F Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040400A
                                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 0040401E
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040403C
                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040404D
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040405C
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040406B
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 00404075
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404083
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404092
                                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 004040F5
                                                                                                                                                                                                        • SendMessageA.USER32(00000000), ref: 004040F8
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404123
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404163
                                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 00404172
                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040417B
                                                                                                                                                                                                        • ShellExecuteA.SHELL32(0000070B,open,00422EA0,00000000,00000000,00000001), ref: 0040418E
                                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 0040419B
                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040419E
                                                                                                                                                                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 004041CA
                                                                                                                                                                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 004041DE
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                                                                                                                        • String ID: K?@$N$open$zhuomian
                                                                                                                                                                                                        • API String ID: 3615053054-1962824091
                                                                                                                                                                                                        • Opcode ID: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                                        • Instruction ID: a34f9f388cf178df8091a403f6a11dec50c515965b2aee4463b3b7977a12a790
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5461C2B1A40209BFEB109F60DD45B6A7BA9FB54705F108136FB04BA2D1C7B8A951CF98
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100038D4 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 234registrymemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00010960), ref: 100038F7
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                                        • FindWindowExA.USER32(?,00000000,#32770,00000000), ref: 10003B3D
                                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003EE), ref: 10003B52
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 10003BF1
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10003C10
                                                                                                                                                                                                          • Part of subcall function 10002C7B: GlobalAlloc.KERNEL32(00000040,00000808,REG_DWORD,10027780,10003020,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?), ref: 10002C96
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$AllocFree$ByteCharCloseFindItemMultiWideWindow
                                                                                                                                                                                                        • String ID: #32770$/B=$/G=$/K=$/N=$/NI=$/NS=$/S=$/T=$/V=$REG_DWORD
                                                                                                                                                                                                        • API String ID: 3499353900-2394764689
                                                                                                                                                                                                        • Opcode ID: 4e48371105ca142b6d9544845e2a5454876a24b9921edead1c57e13581c50ac4
                                                                                                                                                                                                        • Instruction ID: 365e6f5f25b1f83e1dd00ba1fd5339e23cab235de8553f25a2c5091953fb1571
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4e48371105ca142b6d9544845e2a5454876a24b9921edead1c57e13581c50ac4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F0818BB5D01254EFF301DB26CC89EAB37E8FB492C4B01816AF94C9626BC775A841CB31
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F2A870 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 230filememoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,?), ref: 02F2A8B6
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,00000040,?,00000000), ref: 02F2A8E0
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 02F2A912
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,000000F8,00000040,00000000), ref: 02F2A93A
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 02F2A983
                                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 02F2A999
                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 02F2A9B2
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,000000F8,000000F8,00000000), ref: 02F2A9CA
                                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02F2A9D7
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 02F2A9DE
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 02F2A9F8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Read$CloseHandlePointerVirtual$AllocCreateFreeSize
                                                                                                                                                                                                        • String ID: @$MZ$PE
                                                                                                                                                                                                        • API String ID: 190504658-3267401838
                                                                                                                                                                                                        • Opcode ID: 653e1f9bab2a482e8466b68a2fc501b17231b250a364bc4b2168ee1f5c048d0b
                                                                                                                                                                                                        • Instruction ID: 600d29b924ca4babab5fd1a8091ca32262d9167ea34209fec0223a144ffd789b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 653e1f9bab2a482e8466b68a2fc501b17231b250a364bc4b2168ee1f5c048d0b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC91A1B1D003289FEB24CF59CC51BE9B7B8FF4AB50F144199E619A7290D7705A85CF50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                        • DrawTextA.USER32(00000000,00423700,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                        • String ID: F
                                                                                                                                                                                                        • API String ID: 941294808-1304234792
                                                                                                                                                                                                        • Opcode ID: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                                        • Instruction ID: ae885c784bcfecf2f3eb694ec281fa6ca416ae0fe75479e663ed1437ea50fae5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B419A71804249AFCB058FA5DD459BFBFB9FF44315F00812AF951AA1A0C738AA50DFA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404275 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 242stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 004042C0
                                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,?), ref: 004042EC
                                                                                                                                                                                                        • SHBrowseForFolderA.SHELL32(?,0041F8D0,?), ref: 004043A1
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 004043AC
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(zhuomian,00420500), ref: 004043DE
                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,zhuomian), ref: 004043EA
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 004043FA
                                                                                                                                                                                                          • Part of subcall function 004052E8: GetDlgItemTextA.USER32(?,?,00000400,00404430), ref: 004052FB
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                                        • GetDiskFreeSpaceA.KERNEL32(0041F4C8,?,?,0000040F,?,00000000,0041F4C8,0041F4C8,?,?,000003FB,?), ref: 0040449D
                                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044B3
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(00000000,00000400,0041F4B8), ref: 00404507
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
                                                                                                                                                                                                        • String ID: 08bcc5cf9e3fc589107741a5e999ecfa$A$C:\Users\user\AppData\Roaming\360bizhi$zhuomian
                                                                                                                                                                                                        • API String ID: 2246997448-1001853622
                                                                                                                                                                                                        • Opcode ID: af730459850d39b60bbf0d54f0c3d7c5c821983bb6905d82adcfe294716d2a84
                                                                                                                                                                                                        • Instruction ID: 735228c1dd8b1f81b04b8bc6f92d9a1389f0a941abf34816bf15e20d5babff8a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: af730459850d39b60bbf0d54f0c3d7c5c821983bb6905d82adcfe294716d2a84
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7817DB1A00218BBDB11AFA1DD45A9F7BB8EF44314F10813BFA04B62D1C77C9A41CB69
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F22600 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 164registrystringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00000008,?,?,?), ref: 02F22643
                                                                                                                                                                                                        • RegEnumKeyExA.ADVAPI32(?,?,?,?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 02F22685
                                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?,?,?), ref: 02F226A8
                                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(?,?,?,?,?,ServiceName,00000000,?,?,?), ref: 02F226E0
                                                                                                                                                                                                        • lstrcmpA.KERNEL32(?,?,?,?,?), ref: 02F22727
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,?,ServiceName,00000000,?,?,?), ref: 02F22763
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 02F22777
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 02F22639
                                                                                                                                                                                                        • Phu hu, xrefs: 02F22653
                                                                                                                                                                                                        • ServiceName, xrefs: 02F226CE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpen$EnumQueryValuelstrcmp
                                                                                                                                                                                                        • String ID: Phu hu$SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
                                                                                                                                                                                                        • API String ID: 2703301734-63799834
                                                                                                                                                                                                        • Opcode ID: cdfe3aad7cea8194d2344f9d30cb82df62db7c315091f9efc3b3f9a64cf77dce
                                                                                                                                                                                                        • Instruction ID: e5c85667dbb9eb2f269b479b7cd449af22e1c18f7ba1a3fcfa6b5d95cda59d6e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cdfe3aad7cea8194d2344f9d30cb82df62db7c315091f9efc3b3f9a64cf77dce
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A151C371A083559FE730CE24C850BABB7E8AB86B94F04492CFE88D7250EB34D50D8762
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F22910 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 96COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Netbios
                                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$* $2$3$7
                                                                                                                                                                                                        • API String ID: 544444789-1802369251
                                                                                                                                                                                                        • Opcode ID: fe4d7435dedd6983dee458a9887bff787d52269afd13ba7bf8a4ea3a1338217d
                                                                                                                                                                                                        • Instruction ID: ca57f7539d7ab005da1f150e51b06572624381868959a9eab36bb9149677a989
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fe4d7435dedd6983dee458a9887bff787d52269afd13ba7bf8a4ea3a1338217d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1031273260C3915BE311CA28C8507EBB7E5AFCA340F44886DB6C8DB251DA74C50D87A3
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F29BC9 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(user32.dll,?,00000000,02F32E77,02F28005,?,Microsoft Visual C++ Runtime Library,00012010,?,02F2D63C,?,02F2D68C,?,?,?,Runtime Error!Program: ), ref: 02F29BDB
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 02F29BF3
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 02F29C04
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 02F29C11
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                        • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                                                                                                                                        • API String ID: 2238633743-4044615076
                                                                                                                                                                                                        • Opcode ID: 6af1984786a1f4b1fbc26bd875b4f97907b0e5731bfb9ae1224d10ef52827f5b
                                                                                                                                                                                                        • Instruction ID: c4b9e13b512ad84f8d42da7a8d1513bfc7643c5c6d60324a5d5ee18944b0135e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6af1984786a1f4b1fbc26bd875b4f97907b0e5731bfb9ae1224d10ef52827f5b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AE018431FC232ADF9710CEB59C8092ABBEAAB866D4B111839B605D3101DBB4D419CFA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F255E4 Relevance: 13.7, APIs: 9, Instructions: 177COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LCMapStringW.KERNEL32(00000000,00000100,02F2D2FC,00000001,00000000,00000000,02F34E4C,00000100,?,?,02F22ECB,?,?,?,02F2F150,?), ref: 02F25626
                                                                                                                                                                                                        • LCMapStringA.KERNEL32(00000000,00000100,02F2D2F8,00000001,00000000,00000000), ref: 02F25642
                                                                                                                                                                                                        • LCMapStringA.KERNEL32(02F2F150,?,?,?,02F22ECB,?,02F34E4C,00000100,?,?,02F22ECB,?,?,?,02F2F150,?), ref: 02F2568B
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000101,?,?,00000000,00000000,02F34E4C,00000100,?,?,02F22ECB,?,?,?,02F2F150,?), ref: 02F256C3
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 02F2571B
                                                                                                                                                                                                        • LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 02F25731
                                                                                                                                                                                                        • LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 02F25764
                                                                                                                                                                                                        • LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 02F257CC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: String$ByteCharMultiWide
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 352835431-0
                                                                                                                                                                                                        • Opcode ID: a7dbe2b2f66af86254674cddac7665465557182f516ba468fe86848fae9f6893
                                                                                                                                                                                                        • Instruction ID: ce0b3cb4dd49014369d8f2a971135f7d2a2991a78d1c5d8321accf99209db744
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a7dbe2b2f66af86254674cddac7665465557182f516ba468fe86848fae9f6893
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C8518A3294021DEFCF218F94DC44EAEBFB5FB4AB90F504115FA11A1160C3328828DFA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F27EE1 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000010), ref: 02F27F4E
                                                                                                                                                                                                        • GetStdHandle.KERNEL32(000000F4,02F2D63C,00000000,?,00000000,00000010), ref: 02F28024
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000), ref: 02F2802B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$HandleModuleNameWrite
                                                                                                                                                                                                        • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                                                                                                        • API String ID: 3784150691-4022980321
                                                                                                                                                                                                        • Opcode ID: cc4d777ed75df181ac061698b8dd38ff1b38d8d52b8d63434f411eb7256c9dd3
                                                                                                                                                                                                        • Instruction ID: 698f0d446cf1ca6a0133d11a48270eb48e6b29c7a1c8e7697acda3b752832e3a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc4d777ed75df181ac061698b8dd38ff1b38d8d52b8d63434f411eb7256c9dd3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86318372E402286EEB20EA60CC45FDAB76DEB477C4F100556F749E6140E770EA88CE61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405CA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                                        • CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                                        • CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                                        • CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • *?|<>/":, xrefs: 00405CE9
                                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian, xrefs: 00405CA7
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405CA2, 00405CDD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                        • API String ID: 589700163-3048901846
                                                                                                                                                                                                        • Opcode ID: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                                        • Instruction ID: 5f153727bab28e9e0146d4b5ee00b331a23ca9fa80731b33480d586dfd6bff40
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A119055808F912AFB3216245C44BB77F99CF567A0F28847BE5C4632C2C67C5C429B6E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F27D76 Relevance: 12.1, APIs: 8, Instructions: 132COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,02F244A0), ref: 02F27D91
                                                                                                                                                                                                        • GetEnvironmentStrings.KERNEL32(?,?,?,?,02F244A0), ref: 02F27DA5
                                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,02F244A0), ref: 02F27DD1
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,02F244A0), ref: 02F27E09
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,02F244A0), ref: 02F27E2B
                                                                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,02F244A0), ref: 02F27E44
                                                                                                                                                                                                        • GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,02F244A0), ref: 02F27E57
                                                                                                                                                                                                        • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 02F27E95
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EnvironmentStrings$ByteCharFreeMultiWide
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1823725401-0
                                                                                                                                                                                                        • Opcode ID: 0ce9cb5c0038d0bcb367474d0c6284ce6315fb1ec5e1800ff2f76f8766579984
                                                                                                                                                                                                        • Instruction ID: d02f2b834f628b7fa5dfecc77a09e487c279f30311086f2f46bbc033be9b4f79
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ce9cb5c0038d0bcb367474d0c6284ce6315fb1ec5e1800ff2f76f8766579984
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 793102B3D0467A6FE7307A74AC8893BF6DDEA4B2C87010969F752C7140EB218C4D86B1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403E9E Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000EB), ref: 00403EBB
                                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 00403ED7
                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00403EE3
                                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 00403EEF
                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 00403F02
                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 00403F12
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00403F2C
                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00403F36
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                                        • Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                                        • Instruction ID: 00f1469000c5a89127aeec98ef40b5380c975c6b17ce5fce2ee989e1a8c22914
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9216271904745ABCB219F68DD08B5BBFF8AF01715B048A69F895E22E1C738E9048B55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100049D6 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 10004B0D
                                                                                                                                                                                                          • Part of subcall function 10003393: RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                                          • Part of subcall function 1000358F: RegSetValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000), ref: 100035D4
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 10004AE4
                                                                                                                                                                                                          • Part of subcall function 10003656: RegDeleteValueA.ADVAPI32(?,00000000,IsUserActive,Software\360WallPaper,100049B0,00000000,IsUserActive), ref: 10003673
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$CloseQuery$ByteCharCreateDeleteFreeGlobalMultiWide
                                                                                                                                                                                                        • String ID: IsUserActive$REG_DWORD$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 2191732953-573575443
                                                                                                                                                                                                        • Opcode ID: 4a879a8ff3d6c5e0ed0ecddff739f7783221a7412e1ec7e0ca8e9c89c1cdc9ac
                                                                                                                                                                                                        • Instruction ID: 0d4dd0ca8cb0c1e017bd2fba6f78559ea720b6b1b0474100f72e102edfb4d539
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a879a8ff3d6c5e0ed0ecddff739f7783221a7412e1ec7e0ca8e9c89c1cdc9ac
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2416DB6C00209BAFB11DB95CC45EDF7BBDEF59381F104065F608A211AD735AA40DB64
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100037B1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 81COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 100031B1: SearchPathA.KERNEL32(00000000,00000000,00000000,00000104,?,00010000,?,00000000,REG_DWORD), ref: 10003202
                                                                                                                                                                                                          • Part of subcall function 10003292: CreateProcessA.KERNEL32(?,?,10027780,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,10027780), ref: 10003315
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 1000385D
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 10003862
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandle$CreateFreeGlobalPathProcessSearch
                                                                                                                                                                                                        • String ID: %s /s "%s"$D$IsUserActive$REG_DWORD$regedit.exe
                                                                                                                                                                                                        • API String ID: 662912923-3176295603
                                                                                                                                                                                                        • Opcode ID: a2c97a24effc0470d4fc4938de51915cf1c4d037391489e4e230d632c5e633a6
                                                                                                                                                                                                        • Instruction ID: 0d107260ace9053c6934716935416cbdb4bcb4d79190a87c11232889ff830a0d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a2c97a24effc0470d4fc4938de51915cf1c4d037391489e4e230d632c5e633a6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 761103728002187AFB02DB968C46EDF7B7EEF457C0F108025FA04B2019DB35A91186A5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404DE1 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                        • lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                        • SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2531174081-0
                                                                                                                                                                                                        • Opcode ID: 588ac7c460d5d31e4bcafe38edda76350f223ec5c49b888c00d63efa47534775
                                                                                                                                                                                                        • Instruction ID: 2cf2fc7e43d6ef2041dab6756eebc4073d6c30a41a9daa52e20b0ba15f173232
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 588ac7c460d5d31e4bcafe38edda76350f223ec5c49b888c00d63efa47534775
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94217CB1A00108BECB119FA5CD84ADFBFB9FB44354F14807AFA04A6290C3388E419F98
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004046B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004046CB
                                                                                                                                                                                                        • GetMessagePos.USER32 ref: 004046D3
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 004046ED
                                                                                                                                                                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 004046FF
                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404725
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                                        • Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                                        • Instruction ID: 0faaf10df4b3c5b013205b28b163586d08db614e614b64859ce527e54ea6c82f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D014071D00219BADB01DBA4DD45BEEBBB8AB55711F10412AFA10B71C0D7B469018B95
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402B2D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B48
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402B7C
                                                                                                                                                                                                        • SetWindowTextA.USER32(?,?), ref: 00402B8C
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402B9E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                        • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                                        • API String ID: 1451636040-1158693248
                                                                                                                                                                                                        • Opcode ID: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                                        • Instruction ID: c2ae3dc6e7ef4d7981284b04d028e8b0241bece3c18d328e79a1d4abe5e5a81b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DBF01270900109ABEB219F50DD09BAE3779AB04345F00803AFA16B91D1D7B95A559B99
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10002E37 Relevance: 9.1, APIs: 6, Instructions: 130registrymemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegEnumValueA.ADVAPI32(00000930,?,?,?,000006E8,?,00000000,00000930,?,00000000), ref: 10002E7C
                                                                                                                                                                                                          • Part of subcall function 1000237C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,000000FF,?,00000000,?,10003224,?,000000FF,00000000,?,IsUserActive,?,00000000), ref: 10002396
                                                                                                                                                                                                        • RegEnumValueA.ADVAPI32(00000930,00000007,?,?,000006E8,?,?,10003FFD,?,?,?,?), ref: 10002EE1
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000930,?,?,?,?), ref: 10002EF6
                                                                                                                                                                                                        • RegEnumValueA.ADVAPI32(00000930,00000001,?,?,000006E8,?,00000000,00000930,?,?,?,?), ref: 10002F1E
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10002F3B
                                                                                                                                                                                                        • RegEnumValueW.ADVAPI32(00000930,?,00000000,?,000006E8,?,?,10003FFD), ref: 10002F7C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EnumValue$Global$AllocByteCharFreeMultiWide
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 309017271-0
                                                                                                                                                                                                        • Opcode ID: 1281734b4e71dc18fb74d1713490baceaa6a5fa52b8b3d6daad624339a5c763a
                                                                                                                                                                                                        • Instruction ID: 1ed38f9154c17c2ae81838c918547a17f7f6db82f16b67f373f0d76d74db7595
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1281734b4e71dc18fb74d1713490baceaa6a5fa52b8b3d6daad624339a5c763a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7641B37690015EEFEF02CF94CC41AEEBBB9FB08384F014166FA15A2124E735DA659B50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F28B9E Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(00000001,02F2D2FC,00000001,?,00000100,00000001,?,?,?,00000000,00000000,?,02F223F1,?,?,00000001), ref: 02F28BDD
                                                                                                                                                                                                        • GetStringTypeA.KERNEL32(00000000,00000001,02F2D2F8,00000001,?,?,?,00000000,00000000,?,02F223F1,?,?,00000001,?), ref: 02F28BF7
                                                                                                                                                                                                        • GetStringTypeA.KERNEL32(?,?,00000000,00000000,?,00000100,00000001,?,?,?,00000000,00000000,?,02F223F1,?,?), ref: 02F28C2B
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000002,00000000,00000000,00000000,00000000,00000100,00000001,?,?,?,00000000,00000000,?,02F223F1,?), ref: 02F28C63
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?), ref: 02F28CB9
                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 02F28CCB
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: StringType$ByteCharMultiWide
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3852931651-0
                                                                                                                                                                                                        • Opcode ID: fcf9d9c95abb36cfe5612e936c034951b59161e02767be40b84466d2dfbed358
                                                                                                                                                                                                        • Instruction ID: 1dedf89ea0758c179e27cfab1c85887be189a2c53f3cdee6dbed9521f84c3dc2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fcf9d9c95abb36cfe5612e936c034951b59161e02767be40b84466d2dfbed358
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5418272A82229AFDF209F94DC85DEFBF79EB0A6D0F100525FA12D2150D335C959CBA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F22170 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 125fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 02F221B6
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 02F22232
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 02F222D7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                        • String ID: SCSIDISK$\\.\Scsi%d:
                                                                                                                                                                                                        • API String ID: 33631002-2176293039
                                                                                                                                                                                                        • Opcode ID: deda3d715ed35db929659ed015aed9f8fc0a1b2c704dde522c456e063306b1fe
                                                                                                                                                                                                        • Instruction ID: 6a4d16cfad1b5f06c0c954316f98e11955edb8f3803717a6b99a142c2d46522d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: deda3d715ed35db929659ed015aed9f8fc0a1b2c704dde522c456e063306b1fe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F41F3719083609BF331CE648C44B5BBBE4EB86B94F10091CFE95AB2C0D776950EC792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F260AA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetVersionExA.KERNEL32 ref: 02F260C9
                                                                                                                                                                                                        • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 02F260FE
                                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02F2615E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EnvironmentFileModuleNameVariableVersion
                                                                                                                                                                                                        • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
                                                                                                                                                                                                        • API String ID: 1385375860-4131005785
                                                                                                                                                                                                        • Opcode ID: dfdf2fea1d407ff7c4e6b9a98c82aa7280de1aa5357963fd76e99e9dc4d1aab3
                                                                                                                                                                                                        • Instruction ID: c2621fe6ecd8dc9d41166ea5ff60f6373a6cc46f6d7b91a71ed3887a0186eaf8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dfdf2fea1d407ff7c4e6b9a98c82aa7280de1aa5357963fd76e99e9dc4d1aab3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 02311272D412B8AEFB3586709C51B99376D9B07BC8F2404D5E785D6083E731EA8DCB11
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F22800 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 02F2283D
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 02F2287E
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 02F228F1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$\\.\%s
                                                                                                                                                                                                        • API String ID: 33631002-1525991222
                                                                                                                                                                                                        • Opcode ID: dbfeae057d5c47694d718b37e19ab8d8d098b18efa4ae69695fcf8640abdf55e
                                                                                                                                                                                                        • Instruction ID: 0cc14894488cf1734defe00f51269c7f174061186f277c8397078cccd679b48e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dbfeae057d5c47694d718b37e19ab8d8d098b18efa4ae69695fcf8640abdf55e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9921F5B26443126BE330DB18DC85FFB77E8DBC5B50F00492CBB9892284D678D549C662
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000), ref: 00402BDD
                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402BFB
                                                                                                                                                                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402B2D,00000000), ref: 00402C4D
                                                                                                                                                                                                          • Part of subcall function 00402BA9: MulDiv.KERNEL32(00000000,00000064,?), ref: 00402BBE
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402C29
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Windowlstrlen$CountCreateDestroyDialogParamTextTicklstrcatwsprintf
                                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                                        • API String ID: 632923820-2449383134
                                                                                                                                                                                                        • Opcode ID: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                                        • Instruction ID: f5379eef49564d08d05b70d449bc26bfa371e2d4fe50783bab2c047c33a3c2e3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A01927090D225EBDB216F55EE4C99F7B78AB04701B104137F401B12D5C6BCA986CBAE
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10002964 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,10027780,000000FF,?,10004EF9,?,10004EF9,?,000000FF,10027780,00000000,?,00000000), ref: 1000297D
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,10027780,000000FF,REG_DWORD,00020000,00000000,00000000,Software\360WallPaper,?,10004EF9,?,000000FF,10027780,00000000,?), ref: 1000299E
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,REG_DWORD,00000000,?,10004EF9,?,10004EF9,?,000000FF,10027780,00000000,?,00000000), ref: 100029AF
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileWrite$ByteCharMultiWide
                                                                                                                                                                                                        • String ID: REG_DWORD$Software\360WallPaper
                                                                                                                                                                                                        • API String ID: 288293550-949188356
                                                                                                                                                                                                        • Opcode ID: aae883a320d99f53fe983dc8287af01575469b74bc31c1813b52a1f6c8cb6a90
                                                                                                                                                                                                        • Instruction ID: 57ac43b0a0119a90836e9a2894bcbb0978c006eb4cb8721f5ff92849ec4290ec
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aae883a320d99f53fe983dc8287af01575469b74bc31c1813b52a1f6c8cb6a90
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2DF0D47244012ABFEF019FA0EC49DEB3F6EFF08290B144114FA1985024C7329831EBA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10001EAF Relevance: 7.9, APIs: 3, Strings: 2, Instructions: 382stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,10027780,00000000,REG_DWORD), ref: 100020EF
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,10027780,00000000,REG_DWORD), ref: 1000210C
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,10027780,00000000,REG_DWORD), ref: 10002159
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrlen$ByteCharMultiWide
                                                                                                                                                                                                        • String ID: 18$REG_DWORD
                                                                                                                                                                                                        • API String ID: 477651035-3748107123
                                                                                                                                                                                                        • Opcode ID: 22911195e3a13aa2991ff51c6204e7e352f94932cdca006830754f15c4e35233
                                                                                                                                                                                                        • Instruction ID: 10bfe06c9ceeecc4f15360566cd13ea8488ae7e97c63037eb01ad52bf46f24d1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 22911195e3a13aa2991ff51c6204e7e352f94932cdca006830754f15c4e35233
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FD19F75D0424AABFB10CF64C8847EE77F5EF403D4F618169E8159B298EB70AE82CB51
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F27860 Relevance: 7.6, APIs: 5, Instructions: 150COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetStartupInfoA.KERNEL32(?), ref: 02F278BE
                                                                                                                                                                                                        • GetFileType.KERNEL32(00000480), ref: 02F27969
                                                                                                                                                                                                        • GetStdHandle.KERNEL32(-000000F6), ref: 02F279CC
                                                                                                                                                                                                        • GetFileType.KERNEL32(00000000), ref: 02F279DA
                                                                                                                                                                                                        • SetHandleCount.KERNEL32 ref: 02F27A11
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileHandleType$CountInfoStartup
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1710529072-0
                                                                                                                                                                                                        • Opcode ID: 87e264edcf36157686b6ca4b7cce20619d607f4f93e0131f9f2ec9e2847ef1ab
                                                                                                                                                                                                        • Instruction ID: 17a88b498b4bd4cb71fbfa3d28a3d7ff36b697f23d9d9cd9eebd2f43badec472
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 87e264edcf36157686b6ca4b7cce20619d607f4f93e0131f9f2ec9e2847ef1ab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0512831D003658BD720EB38D854B66F7E5EB0B3A9F254A68C792AB2D1D730980DCB51
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?), ref: 00401CC5
                                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401CD2
                                                                                                                                                                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D10
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                                        • Opcode ID: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                                        • Instruction ID: 73f510c38aede9d1999832a0848f44238895318cfbb720f21bd33ecac166bac3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57F0F9B2A04105BFD700EBA4EE89DAFB7BDEB44341B104476F601F21A0C7789D018B29
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F27601 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetLastError.KERNEL32(00000002,00000001,02F29CCA,02F2849F,?,02F2A0D8,?,00000001,00000002,00000002,?,00000000,00000007,?,02F28B99,00000001), ref: 02F27603
                                                                                                                                                                                                        • TlsGetValue.KERNEL32(?,02F28B99,00000001,?,00000008,?,02F253CA,00000001,00000001,02F24DE3,00000000,00000042,00000000,?,00000001,00000000), ref: 02F27611
                                                                                                                                                                                                        • SetLastError.KERNEL32(00000000,?,02F28B99,00000001,?,00000008,?,02F253CA,00000001,00000001,02F24DE3,00000000,00000042,00000000,?,00000001), ref: 02F2765D
                                                                                                                                                                                                          • Part of subcall function 02F29681: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00000000,00000042,00000000,?,00000001,00000000), ref: 02F29777
                                                                                                                                                                                                        • TlsSetValue.KERNEL32(00000000,?,02F28B99,00000001,?,00000008,?,02F253CA,00000001,00000001,02F24DE3,00000000,00000042,00000000,?,00000001), ref: 02F27635
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 02F27646
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2020098873-0
                                                                                                                                                                                                        • Opcode ID: 6e7e6b8fb5f17714755d19b868f11ebcd3bef8d9781e667cfe34a17e693336a0
                                                                                                                                                                                                        • Instruction ID: 92515b65950a4f3e4ffb33638da4464f105b46eb28ef0387af42f93f8947ed42
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6e7e6b8fb5f17714755d19b868f11ebcd3bef8d9781e667cfe34a17e693336a0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1F0F632D452325BE6313B28AC0961ABF65EF13BF17220915FB41D6280DB2084199A90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004055CA Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75572EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75572EE0), ref: 004055D8
                                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                                        • String ID: C:\$|S@
                                                                                                                                                                                                        • API String ID: 3213498283-628904129
                                                                                                                                                                                                        • Opcode ID: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                                        • Instruction ID: 59c8476761b09c245942ad27e65994d154511812b78a9f1548afb2a8e03f2f93
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6F02751904E2166E73262644C04B3B979CDB95310F080837E201B71D1C2B84C82DFAE
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F25502 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(00000000,?,?,02F275D5,02F244EC,02F24545,?,?,?), ref: 02F25536
                                                                                                                                                                                                          • Part of subcall function 02F23DBE: HeapFree.KERNEL32(00000000,?,00000000,00000010,02F32E77,?,02F23F7E,00000009,?,?,02F32E77), ref: 02F23E92
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,02F275D5,02F244EC,02F24545,?,?,?), ref: 02F25551
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32 ref: 02F25559
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32 ref: 02F25561
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32 ref: 02F25569
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalDeleteSection$FreeHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 447823528-0
                                                                                                                                                                                                        • Opcode ID: 719d6f4f00ed8c7b4df3cd3149e3226f6a8a4b3e6d004d44911b2dc3c24c4b69
                                                                                                                                                                                                        • Instruction ID: 0e328fad9e5f45e9d462feab0b3495115673e59bb3613908dd4322acc87570dd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 719d6f4f00ed8c7b4df3cd3149e3226f6a8a4b3e6d004d44911b2dc3c24c4b69
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34F054A1C2003496C9383A2AAD45C5AB63BAF93AD83970631EB549767086394C5CC951
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10003C26 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 438registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close
                                                                                                                                                                                                        • String ID: %s%s%s$BANNER$REG_KEY
                                                                                                                                                                                                        • API String ID: 3535843008-2613144944
                                                                                                                                                                                                        • Opcode ID: 73a4a47dd520e4b43c12f764551808ab1abbe95dd6f6d599f4ecbe5c65a8ad96
                                                                                                                                                                                                        • Instruction ID: 24f839f01534b3f9f3d948b0dba4e4d48467bf0e0abb3077ec95ed3de4646347
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 73a4a47dd520e4b43c12f764551808ab1abbe95dd6f6d599f4ecbe5c65a8ad96
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37F1CAB2D00616EFFB11CB64CCC5AEF73E8EB043D4B128529F949A715AC734AD858B64
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100046FC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 149registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 1000488F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
                                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 3735805505-481102535
                                                                                                                                                                                                        • Opcode ID: 596368eef4a0c09929316cdbfb4e5ab842f2647ea94dda1d72f982f5979cc6ca
                                                                                                                                                                                                        • Instruction ID: 243c4d7ec57fe918d6d0940c97adc4b549421a4db24c1b758ac28f055b654191
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 596368eef4a0c09929316cdbfb4e5ab842f2647ea94dda1d72f982f5979cc6ca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C41CDB1D00285BAFB11DB90CC81FAE77ADEB053C0F618865F604E2159EF74AE548799
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 1000544E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002E37: RegEnumValueA.ADVAPI32(00000930,?,?,?,000006E8,?,00000000,00000930,?,00000000), ref: 10002E7C
                                                                                                                                                                                                          • Part of subcall function 10002E37: RegEnumValueA.ADVAPI32(00000930,00000007,?,?,000006E8,?,?,10003FFD,?,?,?,?), ref: 10002EE1
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 10005585
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 1000558A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseEnumValue
                                                                                                                                                                                                        • String ID: Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 858281747-1146598606
                                                                                                                                                                                                        • Opcode ID: fe8dc8850457a0ae8bfcf4f7bf873a395ca8a7ee23500ccc026f58682d979b55
                                                                                                                                                                                                        • Instruction ID: 523df42ff7ef02b66a7152bd520a16a74cdafb2b48f53f26892e5cdfd4f1cf67
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fe8dc8850457a0ae8bfcf4f7bf873a395ca8a7ee23500ccc026f58682d979b55
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3641E2B6C0011DBFEF12CAC5CC85DEFBFBDEB09295F104466B904A2124E2369E55DBA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100045A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 1000464C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
                                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{01A5D3C5-BC2A-47d0-BECF-4CB678821F9E}.tmp
                                                                                                                                                                                                        • API String ID: 3735805505-481102535
                                                                                                                                                                                                        • Opcode ID: 762580cbeacb7d90e5c7e35d10564c529704a20a3dd38c5c79dbb060ab3f82eb
                                                                                                                                                                                                        • Instruction ID: 2050825871a45bdd784fa5f2d59d59491f3635497cfe19468187b331df60d10b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 762580cbeacb7d90e5c7e35d10564c529704a20a3dd38c5c79dbb060ab3f82eb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D41C2B1D00209ABFF15CB94CC85BAF77BDEF023D0F210029F601A6159EB7559508B96
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100031B1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SearchPathA.KERNEL32(00000000,00000000,00000000,00000104,?,00010000,?,00000000,REG_DWORD), ref: 10003202
                                                                                                                                                                                                          • Part of subcall function 1000237C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,000000FF,?,00000000,?,10003224,?,000000FF,00000000,?,IsUserActive,?,00000000), ref: 10002396
                                                                                                                                                                                                        • SearchPathW.KERNEL32(?,00010000,00000000,?,00000000,10003818), ref: 10003281
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PathSearch$ByteCharMultiWide
                                                                                                                                                                                                        • String ID: IsUserActive$REG_DWORD
                                                                                                                                                                                                        • API String ID: 920241381-872863536
                                                                                                                                                                                                        • Opcode ID: 27675c240e6f9564e6327c227cd004533aa0a95c8e4853104729319132863ccc
                                                                                                                                                                                                        • Instruction ID: 8fc82849368d7217e6239efb2a1568746849bcd7c8bfee583c703a93086b1f46
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27675c240e6f9564e6327c227cd004533aa0a95c8e4853104729319132863ccc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DA21627690011ABBEF02DFA4CC469DF7BB9FF082D0F004564FD11A6158E775DA509B90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004045CE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,00420500,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004044EE,000000DF,?,00000000,00000400), ref: 0040465C
                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00404664
                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00420500), ref: 00404677
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                        • String ID: %u.%u%s%s
                                                                                                                                                                                                        • API String ID: 3540041739-3551169577
                                                                                                                                                                                                        • Opcode ID: 2ec428eac170261c187a92505bdc363d28694616c8309a57a51f10684eba3706
                                                                                                                                                                                                        • Instruction ID: 9ef1d31d43ed7f04e774dbb7b0bf9bfadd02bf4a4dcb113ad37d7c9c7133e094
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ec428eac170261c187a92505bdc363d28694616c8309a57a51f10684eba3706
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23110473B001243BDB10A66D9C46EEF329EDBC6334F14023BF625F61D1E9789D1186A9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                                        • Opcode ID: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                                        • Instruction ID: d7011ec21094a782dcbe7947fab20a41340e67ab4a77a50b5f790120b2995d27
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B52183B1A44104BEDF01AFB5CE5BAAD7A75EF41704F14047EF501B61D1D6B88940D728
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00404D31 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00404D67
                                                                                                                                                                                                        • CallWindowProcA.USER32(?,00000200,?,?), ref: 00404DD5
                                                                                                                                                                                                          • Part of subcall function 00403E83: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 00403E95
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                        • String ID: $08bcc5cf9e3fc589107741a5e999ecfa
                                                                                                                                                                                                        • API String ID: 3748168415-2073574801
                                                                                                                                                                                                        • Opcode ID: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                                        • Instruction ID: ca4354f5c4b8917eef9c40a956cdd667d29c971957ea1c54f02525437b92d001
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B116D71600219BBDF21AF51EC80A9B3A69AF84365F40813BFB08651A1C7789D918FA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10002C7B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000808,REG_DWORD,10027780,10003020,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?), ref: 10002C96
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000408,REG_DWORD,10027780,10003020,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?), ref: 10002CBC
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000004,00000400,00000000,00000000), ref: 10002CD7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocGlobal$ByteCharMultiWide
                                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                                        • API String ID: 2030156529-3740793138
                                                                                                                                                                                                        • Opcode ID: fc64ed17b903e3899c077776821cbd57459736d6cb3056fc7c67814bddabf1b4
                                                                                                                                                                                                        • Instruction ID: f3ab0f1b1d71ccfb36cfdf9fed2a1d9ca7cd58b359c6c0ec9dd6f3fbbbb2432f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fc64ed17b903e3899c077776821cbd57459736d6cb3056fc7c67814bddabf1b4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7AF0C272940320EFF3918F54CC85E5B37F4F789BE1F100229F789A62A8DA355440CB61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10003656 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegDeleteValueA.ADVAPI32(?,00000000,IsUserActive,Software\360WallPaper,100049B0,00000000,IsUserActive), ref: 10003673
                                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                                        • RegDeleteValueW.ADVAPI32(00000000,00000000,100049B0,00000000,IsUserActive), ref: 10003693
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteValue$FreeGlobal
                                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper
                                                                                                                                                                                                        • API String ID: 2301017085-3623357663
                                                                                                                                                                                                        • Opcode ID: 8887cd0fd139457d5349fb5184f25190e08ef9d00bff1fb146f170bdef2a4d25
                                                                                                                                                                                                        • Instruction ID: 2cb8b26031d74d85c98f9d886234eeb30e9260fcc359113f1dbcccb504680b0d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8887cd0fd139457d5349fb5184f25190e08ef9d00bff1fb146f170bdef2a4d25
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B3E092365152627BEE029B25EC0895B7FEEFFC92E2B114839F049C2128DB21CC418650
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004052A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422508,Error launching installer), ref: 004052C8
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 004052D5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • Error launching installer, xrefs: 004052B6
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004052A3
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
                                                                                                                                                                                                        • API String ID: 3712363035-3625802312
                                                                                                                                                                                                        • Opcode ID: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                                        • Instruction ID: ecae64e874cd01a2b34c598d60022b54c52eec95b920328752207242d2311f01
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31E0ECB4A00209BBDB009F64ED09E6B7BBDEB04304F90C522A911E2190D778E9508A79
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00405536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 0040553C
                                                                                                                                                                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405545
                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C), ref: 00405556
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405536
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                        • API String ID: 2659869361-4083868402
                                                                                                                                                                                                        • Opcode ID: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                                        • Instruction ID: a8815a40c5cf52564b0ee38fd83154c3193b14c3492e6d39585f1257e3d031c0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82D0A9A2605A30BEE20232198C09E8B2A09CF02310B054422F200B62D2C2BC8E018FFE
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F246F3 Relevance: 6.5, APIs: 5, Instructions: 278COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 4c32aa1af5f2f7346b1f11cda9e46d333230709083131fe30c4e7343cc9ecb82
                                                                                                                                                                                                        • Instruction ID: 8c5c0dbf0ab35a6dec37ed879fb091550dc32c8424181dab8ba3536aaf604ce7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4c32aa1af5f2f7346b1f11cda9e46d333230709083131fe30c4e7343cc9ecb82
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3491C471D01578ABDB21EF68DC40ADEBABAEB067E4F100611FA14B7280D7B18D48CF64
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F26E3E Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000000,00002020,02F2F578,02F2F578,?,?,02F2730A,?,00000010,02F32E77,00000009,00000009,?,02F23F91,00000010,?), ref: 02F26E5F
                                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,02F2730A,?,00000010,02F32E77,00000009,00000009,?,02F23F91,00000010,?), ref: 02F26E83
                                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,02F2730A,?,00000010,02F32E77,00000009,00000009,?,02F23F91,00000010,?), ref: 02F26E9D
                                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,02F2730A,?,00000010,02F32E77,00000009,00000009,?,02F23F91,00000010,?), ref: 02F26F5E
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,00000000,?,?,02F2730A,?,00000010,02F32E77,00000009,00000009,?,02F23F91,00000010,?,?,02F32E77), ref: 02F26F75
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocVirtual$FreeHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 714016831-0
                                                                                                                                                                                                        • Opcode ID: 6cb79cf3757a4ebcb5eb2b81862556074fd795d9461ec4069d36828a8a684b49
                                                                                                                                                                                                        • Instruction ID: c0e4450516b5ae502126aa352c467756263b5a0470b02fb6ee781145a5af8d95
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6cb79cf3757a4ebcb5eb2b81862556074fd795d9461ec4069d36828a8a684b49
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF312471E807159BD330CF24DC45B21B7B8E746BD5F114A29E265D7780E770A458CB49
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F284B2 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,00000002,00000001,00000001), ref: 02F28579
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3934441357-0
                                                                                                                                                                                                        • Opcode ID: df6c826495669086b203c244a8f23a82741909f65212fbcb5ab84b04aff13554
                                                                                                                                                                                                        • Instruction ID: f2ad7d178e4f5dc8eeeffd6ee0c8483be9d10ddf3c2e928b9b4843e06d151bff
                                                                                                                                                                                                        • Opcode Fuzzy Hash: df6c826495669086b203c244a8f23a82741909f65212fbcb5ab84b04aff13554
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83515B71A00268EFDB11CF68C984A9DBBF6FF463D0F108595EA169B250D770DA58CF60
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F241B4 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(02F34E4C), ref: 02F241F8
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(02F34E4C), ref: 02F24207
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(02F34E4C), ref: 02F2423A
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(02F34E4C), ref: 02F242D2
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Interlocked$Decrement$Increment
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2574743344-0
                                                                                                                                                                                                        • Opcode ID: c64735d05a0694efb44345dec4df4132e7199bfa4ffbbc47731506f0be5d3fa7
                                                                                                                                                                                                        • Instruction ID: dd08e7aedb5c2836d5a134c308711c5b331031ca904c16f526046cc673ef2d47
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c64735d05a0694efb44345dec4df4132e7199bfa4ffbbc47731506f0be5d3fa7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D331F871E05278AFFB229BA1DC45BAA7FAAEB07BE0F100055F7019A1C1C7B445C9CB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F23450 Relevance: 6.1, APIs: 4, Instructions: 95stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 02F2349D
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 02F234C5
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00000104,?,00000002,00000000,00000000), ref: 02F234F7
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001,?,00000000,00000104,?,00000002,00000000,00000000), ref: 02F23523
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3109718747-0
                                                                                                                                                                                                        • Opcode ID: d6cf3c63648c57ddf6d5aa2c6428dcdba499db1eda90e10fa6c49e9600f41d33
                                                                                                                                                                                                        • Instruction ID: 0fbb35d9d3785735b2670b5e3a628e58bec129c981a88739df707b2fac19a473
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6cf3c63648c57ddf6d5aa2c6428dcdba499db1eda90e10fa6c49e9600f41d33
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C2312D76604219BBD720CA54CC42FEBB769EF56750F1005A8FB4597380DBB4AE48CB90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
                                                                                                                                                                                                        • GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
                                                                                                                                                                                                        • VerQueryValueA.VERSION(?,0040900C,?,?,?,?,?,00000000), ref: 00401F24
                                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1404258612-0
                                                                                                                                                                                                        • Opcode ID: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                                        • Instruction ID: 5d9bf0a38514312ff05957db8cc1166864d5adc8fb1377831f0fed305f4f1e15
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E81136B2900109BEDB01EFA5D981DAEBBB9AF04344B20803AF501F61E1D7388A55DB28
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10002C08 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 35memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000808,REG_DWORD,10002FDA,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?,?), ref: 10002C22
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000004,00000400), ref: 10002C3D
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000408,REG_DWORD,10002FDA,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?,?), ref: 10002C4C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocGlobal$ByteCharMultiWide
                                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                                        • API String ID: 2030156529-3740793138
                                                                                                                                                                                                        • Opcode ID: 9ba7816f0905f7030245ccdfafec85fe055ecf30b2794630c4898116e18c86e6
                                                                                                                                                                                                        • Instruction ID: f6eb400b8e10d4381344538113f595ce5c5eebdd765b5859096f662afcad7d3e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ba7816f0905f7030245ccdfafec85fe055ecf30b2794630c4898116e18c86e6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2EF06275584320EFF391CB50CD85F4633E0F708B91F204214F799AA2E8DA7468448F55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401D22
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000), ref: 00401D29
                                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
                                                                                                                                                                                                        • CreateFontIndirectA.GDI32(004093C8), ref: 00401D8A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3272661963-0
                                                                                                                                                                                                        • Opcode ID: f2fc6ce3319c5e561789d0ff15f9acfce02f03e665ec53c0c1a814e211245043
                                                                                                                                                                                                        • Instruction ID: 7786b31e84b17939d49dd2ad1307eeb8220d0898c8d3ce275e00d9fc0f48c68a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2fc6ce3319c5e561789d0ff15f9acfce02f03e665ec53c0c1a814e211245043
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7F0C8B0959740AEE7005770AE6E7993F64A719705F245435F542FA1E3C1BC0800CF3E
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00402012 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402065
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,0040A808,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040211F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360wp\User Data, xrefs: 0040209D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360wp\User Data
                                                                                                                                                                                                        • API String ID: 123533781-1006468001
                                                                                                                                                                                                        • Opcode ID: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                                        • Instruction ID: 9b89665ae90dc8b4180d3c8d33d84192eed4ab63dd5a898af4d907ee2c273e32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F0416FB5A00104AFDB00DFA4CD89E9E7BB9EF49314B20416AF905EB2D1CA79DD41CB64
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F29A28 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Info
                                                                                                                                                                                                        • String ID: $
                                                                                                                                                                                                        • API String ID: 1807457897-3032137957
                                                                                                                                                                                                        • Opcode ID: 485b19e3f7b3aae4c4d875513884afc73c0ed426cfb104c8665437f1af0ee590
                                                                                                                                                                                                        • Instruction ID: 2b9007d19ad4fc8f5686d674459f578ec842831daa1d7288a234a7265c16da3a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 485b19e3f7b3aae4c4d875513884afc73c0ed426cfb104c8665437f1af0ee590
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36415C315482685ADB11D614DC4DBEABF9DEB077C4F2404D5D345CB152D2A64B4CCBF1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F230E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SHSetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,00000001,?,00000103), ref: 02F231C5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                                        • API String ID: 3702945584-2395435937
                                                                                                                                                                                                        • Opcode ID: aeccbc59f6ca068c7e499fe0d1664f3367532c9580b26584de505f1a261c953e
                                                                                                                                                                                                        • Instruction ID: f7c1a11a9ea4bf5da5f4a0695ee0a39a59549f8d27d5646f3fee183cfca88c24
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aeccbc59f6ca068c7e499fe0d1664f3367532c9580b26584de505f1a261c953e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC21E572E042B09BF3218618C8047F777E5EBC3784F5885A9EAC5D7195EF78550C8361
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10003292 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateProcessA.KERNEL32(?,?,10027780,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,10027780), ref: 10003315
                                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                                        • CreateProcessW.KERNEL32(?,?,10027780,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,1000384D), ref: 1000336D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateProcess$FreeGlobal
                                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                                        • API String ID: 4023010479-3740793138
                                                                                                                                                                                                        • Opcode ID: bf5e7a4f0ac82943dd2a548e61c3cf54314dd7c45850d882d51d0582140ecce1
                                                                                                                                                                                                        • Instruction ID: 79578aae78e280bfbc3557a1042b5dc1f117bd97d0e02cdd4c4a421a6e62ab7f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bf5e7a4f0ac82943dd2a548e61c3cf54314dd7c45850d882d51d0582140ecce1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B21B57690010EBBEF029FE0CD458DEBFB6FF0C294B054565FA15A2125DB36EA61AB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00403897 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,00423700), ref: 0040392F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: TextWindow
                                                                                                                                                                                                        • String ID: 2052$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                        • API String ID: 530164218-2330795339
                                                                                                                                                                                                        • Opcode ID: 025396f58e7aa16d0618e008d42c19969a52e5f0be75b3478bf19f5a2c1eaf00
                                                                                                                                                                                                        • Instruction ID: 2adf9cbe04a35390a97661ff7fb7b78584b9eec01914685aa61950304d63ee05
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 025396f58e7aa16d0618e008d42c19969a52e5f0be75b3478bf19f5a2c1eaf00
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A911CFB1F046119BC734AF15EC809377BBDEB88726369817BE901A73D1C63D9A029A58
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10004945 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                                          • Part of subcall function 10003656: RegDeleteValueA.ADVAPI32(?,00000000,IsUserActive,Software\360WallPaper,100049B0,00000000,IsUserActive), ref: 10003673
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 100049B7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharCloseDeleteFreeGlobalMultiValueWide
                                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper
                                                                                                                                                                                                        • API String ID: 2348214401-3623357663
                                                                                                                                                                                                        • Opcode ID: 32a5098b3b3792e2d1f6d350db3674fc5a49eab3fc1276cf718b585f818e8a30
                                                                                                                                                                                                        • Instruction ID: 5fe10952a492746ac63a388213dd0f829e5abeace9a43b19803b691c94aaf9e3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32a5098b3b3792e2d1f6d350db3674fc5a49eab3fc1276cf718b585f818e8a30
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F01D276800204BBFB11CB51CC0AF9F7BADDF417E0F200065FA04A215ADB75AE0196A4
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 10003100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileA.KERNEL32(00000000,00000002,00000000,00000000,40000000,?,10004D86,10027780,Software\360WallPaper,?,10004D86,IsUserActive,40000000,00000000,00000000,00000002), ref: 1000312D
                                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000080,00000002,00000000,00000000,40000000,?,10004D86,?,10004D86,IsUserActive,40000000,00000000,00000000,00000002,00000080,00000000), ref: 1000315B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateFile$FreeGlobal
                                                                                                                                                                                                        • String ID: Software\360WallPaper
                                                                                                                                                                                                        • API String ID: 1218761222-3217021507
                                                                                                                                                                                                        • Opcode ID: 3111603f14ea56399cb1f6a9fb0847b370255bdcd137278cc312b1045e311fa1
                                                                                                                                                                                                        • Instruction ID: 74c5b6659c73766a368cdaed38220c824ad993bcbbf413254767937a812eba87
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3111603f14ea56399cb1f6a9fb0847b370255bdcd137278cc312b1045e311fa1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B01B23610015ABBEF029F94EC05CDB3FAAFF8C2A0B008425FA1891124D736D971AB90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F23310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: TrustVerify
                                                                                                                                                                                                        • String ID: ,$O
                                                                                                                                                                                                        • API String ID: 3336249576-3651001137
                                                                                                                                                                                                        • Opcode ID: 5be109bc365e0ff410d08bd64d69ad3283d89c31e0595d1c0eb41d764635f81b
                                                                                                                                                                                                        • Instruction ID: 427231eca5e69d4a46b26da59210ff6c34da0f3a839e484dcad73e878e9a6b84
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5be109bc365e0ff410d08bd64d69ad3283d89c31e0595d1c0eb41d764635f81b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DF11AFB050C3828ED311CF28844464BBFE1AFE6704F048A6EF1D58A292D3B686498B97
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 004024B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000011), ref: 004024CE
                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 004024ED
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\System.dll, xrefs: 004024BC, 004024E1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileWritelstrlen
                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsj5B55.tmp\System.dll
                                                                                                                                                                                                        • API String ID: 427699356-4171637753
                                                                                                                                                                                                        • Opcode ID: 4b9a8f95d8e6fe6c33bef471b69875b5f2e2fd1ae903229e5d04e5c59b4d2165
                                                                                                                                                                                                        • Instruction ID: bca52da527a61a3068b9a7417769ad1d2fd465c434b27635418a89c8b40edd75
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4b9a8f95d8e6fe6c33bef471b69875b5f2e2fd1ae903229e5d04e5c59b4d2165
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CF0E9B2A54240BFD700EBE19E49AAB3668DB41305F20843BB142F51C2D6BD89819B3D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 1000316C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000000,IsUserActive,00000000,10003387,?,100037F9,IsUserActive,IsUserActive,00000400,?,?,?,?), ref: 10003185
                                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?,10003387,?,100037F9,IsUserActive,IsUserActive,00000400,?,?,?,?), ref: 100031A1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AttributesFile$FreeGlobal
                                                                                                                                                                                                        • String ID: IsUserActive
                                                                                                                                                                                                        • API String ID: 3116069549-960559786
                                                                                                                                                                                                        • Opcode ID: b0040dd0d3c89e14ca5a3306b12d4be60eadcb490ea2262c82b620b1b288e48a
                                                                                                                                                                                                        • Instruction ID: 305a3f1c30f4f05c2244c7c445180b7159b1366a742890e0fe54cc613a0ea0da
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b0040dd0d3c89e14ca5a3306b12d4be60eadcb490ea2262c82b620b1b288e48a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7E086366441217BFA029739ED4899F3BEAEFC93F27654639F018C20A8DB24CC418551
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040557D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 00405583
                                                                                                                                                                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 00405591
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 0040557D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharPrevlstrlen
                                                                                                                                                                                                        • String ID: C:\Program Files (x86)\360\360Desktop\modules
                                                                                                                                                                                                        • API String ID: 2709904686-4274933745
                                                                                                                                                                                                        • Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                                        • Instruction ID: a78a31216ab9b60c328ce82f5fccc260d5afe3ad280ceae17d90b4b54361c34b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56D09E62509AA06EE30266549C04B9B6A49DB16710F195862E540A6195C2785D418EA9
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 100022B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MessageBoxW.USER32(00000000,WideInitialize() required.,WideFunc.h header,00000010), ref: 100022D5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2154089046.0000000010001000.00000020.00000001.01000000.00000015.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154032888.0000000010000000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154127683.0000000010006000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154243810.0000000010007000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154307505.0000000010027000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154361964.0000000010047000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2154429870.0000000010058000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message
                                                                                                                                                                                                        • String ID: WideFunc.h header$WideInitialize() required.
                                                                                                                                                                                                        • API String ID: 2030045667-1193123403
                                                                                                                                                                                                        • Opcode ID: c06a0c939cd463eb93c852ebc662a5d4828bb1a1b56a4cc0927362c1b7063354
                                                                                                                                                                                                        • Instruction ID: b7ecd952ef69b07184ea3c549d6369c39419215407db36073fbb9cb7351f4b52
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c06a0c939cd463eb93c852ebc662a5d4828bb1a1b56a4cc0927362c1b7063354
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17C04C30DD1761EBFA21C7608D49B813252F7197F7F218744F369250EDC3B520549559
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F2699C Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapReAlloc.KERNEL32(00000000,?,?,00000000,02F26764,?,?,02F32E77,02F23F33,?,?,?,02F32E77), ref: 02F269C4
                                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,02F26764,?,?,02F32E77,02F23F33,?,?,?,02F32E77), ref: 02F269F8
                                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,02F32E77), ref: 02F26A12
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,?,02F32E77), ref: 02F26A29
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocHeap$FreeVirtual
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3499195154-0
                                                                                                                                                                                                        • Opcode ID: b193eeb2dc57118cc3658c11925d33f89c511b5a2b1e90bfc64e47d646945a4f
                                                                                                                                                                                                        • Instruction ID: 61d55232d9581639ab4c28a788f75e7474f2ba3367ce9d4ce47ad9bb4be2c949
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b193eeb2dc57118cc3658c11925d33f89c511b5a2b1e90bfc64e47d646945a4f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2A113D32A802099FC731DF18EC45A52BBF7FB867957114D19E252C71A0D7B198A6CF00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0040568F Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004056AF
                                                                                                                                                                                                        • CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004056BD
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2151835618.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151782693.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151887599.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2151921841.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2152131156.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                                        • Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                                        • Instruction ID: f65b762de9c196bf4895d9b9c03b18621a66a0ffa1d04d6b890c27cf309056ad
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0EF0A736249D51DBC2025B655C04E7B7E94EF92354B640D7AF444F2240D33A98159FBF
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 02F254D9 Relevance: 5.0, APIs: 4, Instructions: 12COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(?,02F27582,?,02F24483), ref: 02F254E6
                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32 ref: 02F254EE
                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32 ref: 02F254F6
                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32 ref: 02F254FE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000011.00000002.2153808865.0000000002F21000.00000020.00000001.01000000.00000010.sdmp, Offset: 02F20000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153768194.0000000002F20000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153848539.0000000002F2D000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153887938.0000000002F2F000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153930187.0000000002F31000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000011.00000002.2153964462.0000000002F35000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_2f20000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalInitializeSection
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 32694325-0
                                                                                                                                                                                                        • Opcode ID: d5e5bbc2958aa0b05ea6bfdb90b0fbf58b2dd18df4c43b377d187aebe595f864
                                                                                                                                                                                                        • Instruction ID: 66d968a9b42ebbb642d74eae1003dfcd48abbedd62e8856f5a53d09cab9d3f58
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d5e5bbc2958aa0b05ea6bfdb90b0fbf58b2dd18df4c43b377d187aebe595f864
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0FC0E971CB502C9ACA716BA5FD14845BE36FB46AE03060A62B5055143486751C39DF90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                        Function 00CAE6D0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 359stringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 497 cae6d0-cae74b call cb1510 SHGetFolderPathW lstrcatW 500 cae750-cae759 497->500 500->500 501 cae75b-cae783 call ca7aa0 500->501 504 cae78b-cae797 call cb3668 501->504 505 cae785 501->505 508 cae79d-cae7a3 504->508 509 caeb91-caeb97 504->509 505->504 512 cae7b3 508->512 513 cae7a5-cae7ad 508->513 510 caeba8-caebc9 call cb1970 509->510 511 caeb99-caeba5 call cb0f32 509->511 511->510 515 cae7b9-cae7c6 lstrlenW 512->515 513->515 516 cae7af-cae7b1 513->516 520 cae7c8-cae7ca 515->520 521 cae7cc-cae7e2 call cb3680 call ca2960 515->521 519 cae7e4-cae824 call ca4520 call ca4590 call ca4520 call cb354b call ca4330 516->519 537 cae82a-cae82f 519->537 538 caeb84-caeb8c call ca4590 519->538 520->519 521->519 540 cae839 537->540 541 cae831-cae837 537->541 538->509 542 cae83c-cae846 540->542 541->542 544 cae848-cae85b call ca4590 call ca7530 542->544 545 cae860-cae87d call ca4420 542->545 544->510 551 cae9e3-caea02 call ca4420 545->551 552 cae883-cae89b call ca4420 545->552 551->538 558 caea08-caea20 call ca4420 551->558 552->551 559 cae8a1-cae8ee 552->559 558->538 564 caea26 558->564 561 cae8f5-cae90c call ca4420 559->561 566 cae90e-cae923 call ca44a0 561->566 567 cae97f-cae985 561->567 568 caea32-caea7d 564->568 576 cae92e 566->576 577 cae925-cae92c 566->577 567->561 570 cae98b-cae992 567->570 571 caea84-caea9b call ca4420 568->571 573 cae9bb-cae9dd call ca6e90 call cab770 570->573 574 cae994-cae99b 570->574 583 caeaa1-caeab6 call ca44a0 571->583 584 caeb46-caeb4c 571->584 573->551 573->559 574->573 578 cae99d-cae9a4 574->578 581 cae933-cae935 576->581 577->576 577->581 578->573 582 cae9a6-cae9ad 578->582 587 cae938-cae93d 581->587 582->573 586 cae9af-cae9b8 call cae610 582->586 598 caeab8-caeabf 583->598 599 caeac1 583->599 584->571 590 caeb52-caeb7e call cae610 call ca6e90 call cab770 584->590 586->573 587->587 592 cae93f-cae941 587->592 590->538 614 caea30 590->614 592->567 597 cae943-cae96e call ca4a80 call cadd40 592->597 597->567 615 cae970-cae97c call cb0f32 597->615 598->599 602 caeac6-caeacb 598->602 599->602 606 caead0-caead5 602->606 606->606 607 caead7-caead9 606->607 607->584 610 caeadb-caeafa 607->610 613 caeb00-caeb05 610->613 613->613 616 caeb07-caeb35 call ca5740 call cadd40 613->616 614->568 615->567 616->584 623 caeb37-caeb43 call cb0f32 616->623 623->584
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAE6FD
                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CAE711
                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\360desktop\loopwallpaper.xml), ref: 00CAE723
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 00CAE7BA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath_memsetlstrcatlstrlen
                                                                                                                                                                                                        • String ID: \360desktop\loopwallpaper.xml$catelog_id$favorite$favorites$favorites_will_download$value
                                                                                                                                                                                                        • API String ID: 3348383912-4284236780
                                                                                                                                                                                                        • Opcode ID: 2636ff523891c333efdcbf5c85c1be9790f0ac575134865bd1f47124315a28a8
                                                                                                                                                                                                        • Instruction ID: 82de7a796c48f7b1f2274c326902f3d077632c97fbec45141502b6299361e58e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2636ff523891c333efdcbf5c85c1be9790f0ac575134865bd1f47124315a28a8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1E1707190034ACBDF35DFA4DC85BEE77B8BF55308F044529E91A9B251EB709A08DB90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAF3B0 Relevance: 109.0, APIs: 41, Strings: 21, Instructions: 499windowCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 0 caf3b0-caf41b call cb1510 StrStrIW 3 caf41d-caf425 0->3 4 caf427-caf431 StrStrIW 0->4 7 caf46e-caf4a1 SHGetValueW PathFileExistsW 3->7 5 caf43d-caf447 StrStrIW 4->5 6 caf433-caf43b 4->6 8 caf449 5->8 9 caf44e-caf458 StrStrIW 5->9 6->7 10 caf4a3-caf4b5 call ca1000 7->10 11 caf4c5 7->11 8->9 9->7 12 caf45a-caf45c 9->12 21 caf9e7-caf9e9 10->21 22 caf4bb-caf4c3 10->22 14 caf4c9-caf4d3 StrStrIW 11->14 12->7 15 caf45e-caf468 StrStrIW 12->15 17 caf50c-caf54b SHSetValueW 14->17 18 caf4d5-caf4d9 14->18 15->7 15->21 19 caf551-caf575 SHSetValueW call cad9d0 17->19 20 caf635-caf669 SHGetValueW 17->20 18->17 23 caf4db-caf4f1 MessageBoxW 18->23 31 caf57a-caf57c 19->31 24 caf708-caf73c SHGetValueW 20->24 25 caf66f-caf6b7 SHSetValueW call cae6d0 20->25 29 cafa94-cafaac call cb1970 21->29 22->14 26 caf7d0-caf876 call ca6980 call ca5a70 call ca56d0 call cadd00 call cabe80 DeleteFileW call cb1510 SHGetFolderPathW call ca6980 call ca5a70 23->26 27 caf4f7-caf506 ShellExecuteW 23->27 33 caf76b-caf779 StrStrIW 24->33 34 caf73e call cad0b0 24->34 43 caf6b9 call caf190 25->43 44 caf6be-caf702 call cb1510 SHGetFolderPathW lstrcatW DeleteFileW 25->44 81 cafa3a 26->81 82 caf87c-caf880 26->82 27->17 31->20 37 caf582-caf5a4 call cb1510 31->37 41 cafa8f 33->41 42 caf77f-caf783 33->42 46 caf743-caf745 34->46 57 caf5b0-caf5c6 37->57 41->29 42->26 48 caf785-caf7a9 call ca7bc0 call ca7b90 42->48 43->44 44->24 46->33 54 caf747-caf769 SHSetValueW 46->54 65 caf7ab 48->65 66 caf7af-caf7cb ShellExecuteW call ca7530 48->66 54->33 57->57 60 caf5c8-caf5fb PathRemoveArgsW PathAppendW call ca1000 57->60 60->20 71 caf5fd-caf604 60->71 65->66 66->26 73 caf607-caf610 71->73 73->73 75 caf612-caf633 SHSetValueW 73->75 75->20 84 cafa3e-cafa4e 81->84 82->81 83 caf886-caf88d 82->83 85 caf88f-caf89c call ca54e0 83->85 86 caf8a0-caf8a9 PathFileExistsW 83->86 87 cafa5a-cafa6a 84->87 88 cafa50-cafa55 84->88 85->86 86->84 92 caf8af-caf8e6 SHGetValueW 86->92 90 cafa6c-cafa71 87->90 91 cafa76-cafa83 87->91 88->87 90->91 91->41 93 cafa85-cafa8c 91->93 95 caf8e8-caf8ec 92->95 96 caf8f2-caf919 CoInitialize DefWindowProcW call ca8ac0 92->96 93->41 95->84 95->96 99 caf91f-caf9b4 GdiplusStartup SHSetValueW call cab570 call cab830 96->99 100 cafa23-cafa38 CoUninitialize GetCurrentProcess TerminateProcess 96->100 105 caf9ee-cafa1e ShowWindow call ca8a20 call cabe40 GdiplusShutdown call ca8c10 99->105 106 caf9b6-caf9e2 call ca4760 call ca8c10 call ca4a60 * 3 99->106 100->84 105->100 106->21
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAF3FD
                                                                                                                                                                                                        • StrStrIW.KERNELBASE(?,/s StartFrom=360wpsrv), ref: 00CAF417
                                                                                                                                                                                                        • StrStrIW.SHLWAPI(?,StartFrom=360wpsrv), ref: 00CAF42D
                                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe,00000000,?,?,?), ref: 00CAF48B
                                                                                                                                                                                                        • PathFileExistsW.KERNELBASE(?), ref: 00CAF499
                                                                                                                                                                                                        • StrStrIW.SHLWAPI(?,onlyimport), ref: 00CAF4CF
                                                                                                                                                                                                        • MessageBoxW.USER32(00000000,00CC6674,00CC6698,00000014), ref: 00CAF4E8
                                                                                                                                                                                                        • ShellExecuteW.SHELL32(00000000,open,http://bizhi.360.cn/,00000000,00000000,00000005), ref: 00CAF506
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,recordloopinfo,?,?,?), ref: 00CAF53B
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI ref: 00CAF573
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAF59A
                                                                                                                                                                                                        • PathRemoveArgsW.SHLWAPI(?), ref: 00CAF5D0
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$Path_memset$ArgsExecuteExistsFileMessageRemoveShell
                                                                                                                                                                                                        • String ID: StartFrom=4$/s StartFrom=360wpsrv$360WallPaper$360wpsrv.exe$Main dialog creation failed!$SOFTWARE\360WallPaper$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$StartFrom=360wpsrv$\360desktop\loopwallpaper.xml$\360wp\User Data\First Run$dtdescription$http://bizhi.360.cn/$http://stat.apc.360.cn/stat.html?type=new&action=zidaiyingyong&from=7&fangshi=$onlyimport$open$recordlocalfav$recordloginid$recordloopinfo$wallpaper.swf$wallpaper_cm.swf
                                                                                                                                                                                                        • API String ID: 3855544870-4270518405
                                                                                                                                                                                                        • Opcode ID: a7e0f15ed668429b0d6a841e3dd30242cc3c65fb0eab5959897898283f42f931
                                                                                                                                                                                                        • Instruction ID: 51221f3a782de6d2c2ca37889b2908feaf0bf453816f3e4d39afbd55d7dd4fd6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a7e0f15ed668429b0d6a841e3dd30242cc3c65fb0eab5959897898283f42f931
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B028F71504342ABD324DB60CC86FAFB7E8FFD9708F048A2DF59596191EB709A05CB62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAF5A6 Relevance: 63.3, APIs: 22, Strings: 14, Instructions: 304filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 121 caf5a6-caf5ad 122 caf5b0-caf5c6 121->122 122->122 123 caf5c8-caf5fb PathRemoveArgsW PathAppendW call ca1000 122->123 126 caf5fd-caf604 123->126 127 caf635-caf669 SHGetValueW 123->127 130 caf607-caf610 126->130 128 caf708-caf73c SHGetValueW 127->128 129 caf66f-caf6b7 SHSetValueW call cae6d0 127->129 132 caf76b-caf779 StrStrIW 128->132 133 caf73e-caf745 call cad0b0 128->133 139 caf6b9 call caf190 129->139 140 caf6be-caf702 call cb1510 SHGetFolderPathW lstrcatW DeleteFileW 129->140 130->130 134 caf612-caf633 SHSetValueW 130->134 137 cafa8f 132->137 138 caf77f-caf783 132->138 133->132 150 caf747-caf769 SHSetValueW 133->150 134->127 141 cafa94-cafaac call cb1970 137->141 143 caf7d0-caf876 call ca6980 call ca5a70 call ca56d0 call cadd00 call cabe80 DeleteFileW call cb1510 SHGetFolderPathW call ca6980 call ca5a70 138->143 144 caf785-caf7a9 call ca7bc0 call ca7b90 138->144 139->140 140->128 174 cafa3a 143->174 175 caf87c-caf880 143->175 159 caf7ab 144->159 160 caf7af-caf7cb ShellExecuteW call ca7530 144->160 150->132 159->160 160->143 177 cafa3e-cafa4e 174->177 175->174 176 caf886-caf88d 175->176 178 caf88f-caf89c call ca54e0 176->178 179 caf8a0-caf8a9 PathFileExistsW 176->179 180 cafa5a-cafa6a 177->180 181 cafa50-cafa55 177->181 178->179 179->177 185 caf8af-caf8e6 SHGetValueW 179->185 183 cafa6c-cafa71 180->183 184 cafa76-cafa83 180->184 181->180 183->184 184->137 186 cafa85-cafa8c 184->186 188 caf8e8-caf8ec 185->188 189 caf8f2-caf919 CoInitialize DefWindowProcW call ca8ac0 185->189 186->137 188->177 188->189 192 caf91f-caf9b4 GdiplusStartup SHSetValueW call cab570 call cab830 189->192 193 cafa23-cafa38 CoUninitialize GetCurrentProcess TerminateProcess 189->193 198 caf9ee-cafa1e ShowWindow call ca8a20 call cabe40 GdiplusShutdown call ca8c10 192->198 199 caf9b6-caf9e9 call ca4760 call ca8c10 call ca4a60 * 3 192->199 193->177 198->193 199->141
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • PathRemoveArgsW.SHLWAPI(?), ref: 00CAF5D0
                                                                                                                                                                                                        • PathAppendW.SHLWAPI(?,360wpsrv.exe), ref: 00CAF5E3
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,360WallPaper,00000001,?), ref: 00CAF633
                                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,recordlocalfav,?,?,?), ref: 00CAF65F
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI ref: 00CAF691
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAF6CC
                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,00000004,?,00000004), ref: 00CAF6E1
                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\360desktop\loopwallpaper.xml), ref: 00CAF6F4
                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?), ref: 00CAF702
                                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,recordloginid,?,?,?), ref: 00CAF732
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001), ref: 00CAF769
                                                                                                                                                                                                        • StrStrIW.SHLWAPI(?,onlyimport), ref: 00CAF771
                                                                                                                                                                                                        • ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000005), ref: 00CAF7C1
                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?), ref: 00CAF81D
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAF831
                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CAF846
                                                                                                                                                                                                        • PathFileExistsW.SHLWAPI(?,\360wp\User Data\First Run,0000001A,?), ref: 00CAF8A1
                                                                                                                                                                                                          • Part of subcall function 00CAD0B0: _memset.LIBCMT ref: 00CAD0F4
                                                                                                                                                                                                          • Part of subcall function 00CAD0B0: GetModuleFileNameW.KERNEL32(00000000,?,00000207), ref: 00CAD107
                                                                                                                                                                                                          • Part of subcall function 00CAD0B0: PathRemoveFileSpecW.SHLWAPI(?), ref: 00CAD112
                                                                                                                                                                                                          • Part of subcall function 00CAD0B0: PathAppendW.SHLWAPI(?,360Login.dll), ref: 00CAD122
                                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,dtdescription,?,?,?), ref: 00CAF8DE
                                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 00CAF8F3
                                                                                                                                                                                                        • DefWindowProcW.USER32(00000000,00000000,00000000,00000000), ref: 00CAF8FD
                                                                                                                                                                                                        • GdiplusStartup.GDIPLUS ref: 00CAF94C
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,dtdescription,00000004,?,00000004), ref: 00CAF971
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PathValue$File$_memset$AppendDeleteFolderRemove$ArgsExecuteExistsGdiplusInitializeModuleNameProcShellSpecStartupWindowlstrcat
                                                                                                                                                                                                        • String ID: StartFrom=4$360WallPaper$360wpsrv.exe$Main dialog creation failed!$SOFTWARE\360WallPaper$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\360desktop\loopwallpaper.xml$\360wp\User Data\First Run$dtdescription$http://stat.apc.360.cn/stat.html?type=new&action=zidaiyingyong&from=7&fangshi=$onlyimport$open$recordlocalfav$recordloginid
                                                                                                                                                                                                        • API String ID: 2306431065-3313355496
                                                                                                                                                                                                        • Opcode ID: 1ee781375799c54dcc945c9a9a4fc2a66c3c690c3ae30eada05184959e31b19e
                                                                                                                                                                                                        • Instruction ID: 2f133e42d02beb92542adb6fa5880bd6222cceb79ad0e8e95b5923d4ff02aae5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ee781375799c54dcc945c9a9a4fc2a66c3c690c3ae30eada05184959e31b19e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8B18C71504342ABC324EB60DC86FAFB7E8FFD5708F04892DF18692151EBB09A05DB62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C926890 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 162synchronizationmemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(ECBB529E,?,?,?,?,?,?,?,?,?,?,6C93744B,000000FF), ref: 6C9268D7
                                                                                                                                                                                                        • __snwprintf.LIBCMT ref: 6C9268F1
                                                                                                                                                                                                        • CreateMutexW.KERNELBASE(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C93744B), ref: 6C92690B
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C93744B,000000FF), ref: 6C92691E
                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?,6C93744B), ref: 6C92692E
                                                                                                                                                                                                        • GetEnvironmentVariableW.KERNEL32(1830B7BD-F7A3-4c4d-989B-C004DE465EDE,?,0000001F), ref: 6C926949
                                                                                                                                                                                                        • _swscanf.LIBCMT ref: 6C926971
                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(00000000), ref: 6C926994
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 6C92699F
                                                                                                                                                                                                        • GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C93744B,000000FF), ref: 6C9269CE
                                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000000,00000000,000005C0), ref: 6C9269DF
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C926A18
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 6C926A33
                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(1830B7BD-F7A3-4c4d-989B-C004DE465EDE,?), ref: 6C926A47
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C926A65
                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(1830B7BD-F7A3-4c4d-989B-C004DE465EDE,00000000,?,6C954C40), ref: 6C926A71
                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 6C926A7B
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6C926A9A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EnvironmentMutexVariable$CloseException@8HandleHeapProcessReleaseThrow$AllocCreateCurrentErrorLastObjectSingleWait__snwprintf__swprintf_swscanf
                                                                                                                                                                                                        • String ID: %s %u$%x:%x$1830B7BD-F7A3-4c4d-989B-C004DE465EDE
                                                                                                                                                                                                        • API String ID: 2628509032-3989918790
                                                                                                                                                                                                        • Opcode ID: d6e9f3fbd70cddacde0683faeb0ccc51140d487fbfc26fd7498b0f8905abb7d6
                                                                                                                                                                                                        • Instruction ID: 8098c0cefd314deb4973b12f592fd492880a19d657548ff348cfb2b9b0a3a567
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6e9f3fbd70cddacde0683faeb0ccc51140d487fbfc26fd7498b0f8905abb7d6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F251D271A14604EBDB14DF94C848BEE7BB8FB49B04F108529E949E7A40DB38D604CB61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C1E50 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 351filesynchronizationCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 252 6c8c1e50-6c8c1e97 253 6c8c1e9d-6c8c1ee9 call 6c897a80 call 6c8a7210 252->253 254 6c8c203f-6c8c2041 252->254 262 6c8c1eeb-6c8c1ef6 GetLastError 253->262 263 6c8c1f04-6c8c1f46 WaitForSingleObject CreateEventW 253->263 256 6c8c2370-6c8c238b call 6c908660 254->256 262->263 264 6c8c1ef8-6c8c1eff call 6c8c10f0 262->264 265 6c8c1f48-6c8c1f53 GetLastError 263->265 266 6c8c1f61-6c8c1f93 MapViewOfFile 263->266 264->263 265->266 268 6c8c1f55-6c8c1f5c call 6c8c10f0 265->268 271 6c8c1f99-6c8c1fbc 266->271 272 6c8c2046-6c8c204a 266->272 268->266 277 6c8c1fbe-6c8c1fc5 CloseHandle 271->277 278 6c8c1fcb-6c8c1fea ReleaseMutex 271->278 273 6c8c204c-6c8c207a call 6c8c2ab0 272->273 274 6c8c207f-6c8c20ac UnmapViewOfFile 272->274 273->274 282 6c8c20ae-6c8c20b5 FindCloseChangeNotification 274->282 283 6c8c20bb-6c8c20de ReleaseMutex 274->283 277->278 280 6c8c1fec-6c8c1ff3 CloseHandle 278->280 281 6c8c1ff9-6c8c2001 278->281 280->281 284 6c8c200c-6c8c2031 call 6c908655 281->284 285 6c8c2003-6c8c2009 call 6c908655 281->285 282->283 286 6c8c20e7-6c8c20f3 283->286 287 6c8c20e0-6c8c20e1 CloseHandle 283->287 284->254 297 6c8c2033-6c8c203c call 6c908655 284->297 285->284 290 6c8c20f9-6c8c2108 call 6c897ae0 286->290 291 6c8c218a-6c8c218c 286->291 287->286 302 6c8c210a-6c8c2113 call 6c908655 290->302 303 6c8c2116-6c8c211b 290->303 292 6c8c218e call 6c908e84 291->292 293 6c8c2193-6c8c21c6 call 6c8e3360 291->293 292->293 305 6c8c21c8 293->305 306 6c8c21cb-6c8c21df call 6c8d47a0 293->306 297->254 302->303 303->256 309 6c8c2170-6c8c2185 call 6c897ae0 call 6c89a760 303->309 305->306 315 6c8c21e0-6c8c21e8 306->315 309->256 317 6c8c21fa-6c8c223d call 6c90c210 * 2 call 6c8e1ba0 315->317 318 6c8c21ea-6c8c21f3 315->318 332 6c8c223f call 6c908e84 317->332 333 6c8c2244-6c8c2265 call 6c8e20c0 317->333 318->315 320 6c8c21f5 318->320 322 6c8c2299-6c8c22e5 call 6c8fca10 call 6c89a020 320->322 337 6c8c22ed-6c8c2330 call 6c8fcb10 call 6c894f10 322->337 338 6c8c22e7 322->338 332->333 340 6c8c226a-6c8c227e call 6c8d47a0 333->340 341 6c8c2267 333->341 351 6c8c233b-6c8c2360 call 6c908655 337->351 352 6c8c2332-6c8c2338 call 6c908655 337->352 338->337 347 6c8c2280-6c8c2288 340->347 341->340 347->309 349 6c8c228e-6c8c2297 347->349 349->322 349->347 357 6c8c236e 351->357 358 6c8c2362-6c8c236b call 6c908655 351->358 352->351 357->256 358->357
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C8A7210: CreateMutexW.KERNELBASE(00000000,00000000,?,ECBB529E,?,00000000,6C937BC8,000000FF,6C8C1EE3), ref: 6C8A724C
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,Local\360Login_mapping_lock,?,ECBB529E,00000000,?,?), ref: 6C8C1EEB
                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,?,Local\360Login_mapping_lock,?,ECBB529E,00000000,?,?), ref: 6C8C1F16
                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000000,00000001,Local\360Login_event), ref: 6C8C1F34
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 6C8C1F48
                                                                                                                                                                                                        • MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00A00000), ref: 6C8C1F89
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6C8C1FBF
                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 6C8C1FDC
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6C8C1FED
                                                                                                                                                                                                        • UnmapViewOfFile.KERNEL32(00000000), ref: 6C8C2080
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(?), ref: 6C8C20AF
                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 6C8C20CC
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6C8C20E1
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 6C8C1113
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,00000000,?,?,6C8C1F61,?), ref: 6C8C1130
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: SetSecurityInfo.ADVAPI32(?,00000006,00000010,00000000,00000000,00000000,?,?,?,6C8C1F61,?), ref: 6C8C114B
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: LocalFree.KERNEL32(?,?,?,6C8C1F61,?), ref: 6C8C115B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • Local\360Login_event, xrefs: 6C8C1F20
                                                                                                                                                                                                        • Local\360Login_mapping_lock, xrefs: 6C8C1ECE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseSecurity$DescriptorHandleMutex$CreateErrorFileLastReleaseView$ChangeConvertEventFindFreeInfoLocalNotificationObjectSaclSingleStringUnmapWait
                                                                                                                                                                                                        • String ID: Local\360Login_event$Local\360Login_mapping_lock
                                                                                                                                                                                                        • API String ID: 2544181147-3510665665
                                                                                                                                                                                                        • Opcode ID: 7076741d2c6b8a137e79b5774e82142f894f7047659b17c824c02af1531c1886
                                                                                                                                                                                                        • Instruction ID: 52a39a637904bf6ecfb6ee05fb8b1162272f2276c1e1ecd20a17db46235c6239
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7076741d2c6b8a137e79b5774e82142f894f7047659b17c824c02af1531c1886
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 59E16071E04259DFDB24DF98C984BDDB7B4BF58304F1089A9D51AA3640DB34AE88CF51
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C1A60 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 244filesynchronizationCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 361 6c8c1a60-6c8c1aa6 362 6c8c1aac-6c8c1ae3 call 6c897a80 call 6c8a7210 361->362 363 6c8c1c42-6c8c1c44 361->363 371 6c8c1afe-6c8c1b4a WaitForSingleObject CreateEventW 362->371 372 6c8c1ae5-6c8c1af0 GetLastError 362->372 364 6c8c1e23-6c8c1e3e call 6c908660 363->364 374 6c8c1b4c-6c8c1b57 GetLastError 371->374 375 6c8c1b65-6c8c1b97 MapViewOfFile 371->375 372->371 373 6c8c1af2-6c8c1af9 call 6c8c10f0 372->373 373->371 374->375 377 6c8c1b59-6c8c1b60 call 6c8c10f0 374->377 380 6c8c1b9d-6c8c1bbf 375->380 381 6c8c1c49-6c8c1c4d 375->381 377->375 386 6c8c1bce-6c8c1bed ReleaseMutex 380->386 387 6c8c1bc1-6c8c1bc8 CloseHandle 380->387 382 6c8c1c4f-6c8c1c65 call 6c8c2ab0 381->382 383 6c8c1c6a-6c8c1c93 UnmapViewOfFile 381->383 382->383 391 6c8c1c95-6c8c1c9c FindCloseChangeNotification 383->391 392 6c8c1ca6-6c8c1cc9 ReleaseMutex 383->392 389 6c8c1bfc-6c8c1c04 386->389 390 6c8c1bef-6c8c1bf6 CloseHandle 386->390 387->386 393 6c8c1c0f-6c8c1c34 call 6c908655 389->393 394 6c8c1c06-6c8c1c0c call 6c908655 389->394 390->389 391->392 395 6c8c1ccb-6c8c1ccc CloseHandle 392->395 396 6c8c1cd2-6c8c1cde 392->396 393->363 406 6c8c1c36-6c8c1c3f call 6c908655 393->406 394->393 395->396 399 6c8c1d78-6c8c1d7a 396->399 400 6c8c1ce4-6c8c1cf3 call 6c897ae0 396->400 404 6c8c1d7c call 6c908e84 399->404 405 6c8c1d81-6c8c1d9e call 6c8e20c0 399->405 412 6c8c1cf5-6c8c1cfe call 6c908655 400->412 413 6c8c1d01-6c8c1d06 400->413 404->405 414 6c8c1da0 405->414 415 6c8c1da3-6c8c1db5 call 6c90a8fc 405->415 406->363 412->413 413->364 418 6c8c1d5e-6c8c1d73 call 6c897ae0 call 6c89a760 413->418 414->415 415->418 424 6c8c1db7-6c8c1e21 call 6c8fca10 call 6c8fcad0 call 6c894f10 call 6c897ae0 call 6c89a760 415->424 418->364 424->364
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C8A7210: CreateMutexW.KERNELBASE(00000000,00000000,?,ECBB529E,?,00000000,6C937BC8,000000FF,6C8C1EE3), ref: 6C8A724C
                                                                                                                                                                                                        • GetLastError.KERNEL32(00000001,Local\360Login_mapping_lock,?,ECBB529E,00000000,?,?), ref: 6C8C1AE5
                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000001,000000FF,00000001,Local\360Login_mapping_lock,?,ECBB529E,00000000,?,?), ref: 6C8C1B13
                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000000,00000001,Local\360Login_event,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539,?,?), ref: 6C8C1B34
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539,?,?), ref: 6C8C1B4C
                                                                                                                                                                                                        • MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539,?), ref: 6C8C1B8D
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000004,?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539), ref: 6C8C1BC2
                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(00000001,?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539), ref: 6C8C1BDF
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000001,?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539), ref: 6C8C1BF0
                                                                                                                                                                                                        • UnmapViewOfFile.KERNEL32(00000000,?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539), ref: 6C8C1C6B
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(00000004,?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539), ref: 6C8C1C96
                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(00000001,?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539), ref: 6C8C1CB7
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000001,?,00000004,00000000,00000000,00A00000,?,?,?,?,?,00000000,6C93E6A5,000000FF,?,6C8C1539), ref: 6C8C1CCC
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 6C8C1113
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,00000000,?,?,6C8C1F61,?), ref: 6C8C1130
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: SetSecurityInfo.ADVAPI32(?,00000006,00000010,00000000,00000000,00000000,?,?,?,6C8C1F61,?), ref: 6C8C114B
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: LocalFree.KERNEL32(?,?,?,6C8C1F61,?), ref: 6C8C115B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseSecurity$DescriptorHandleMutex$CreateErrorFileLastReleaseView$ChangeConvertEventFindFreeInfoLocalNotificationObjectSaclSingleStringUnmapWait
                                                                                                                                                                                                        • String ID: Local\360Login_event$Local\360Login_mapping_lock${"userArray":
                                                                                                                                                                                                        • API String ID: 2544181147-2227511959
                                                                                                                                                                                                        • Opcode ID: 08eb488ed534825489e9034bdcb2e02c6da2b7de68ecf6f20b82e3ff43a405ea
                                                                                                                                                                                                        • Instruction ID: 2b4e4421b5774ff0a3ea141412820f0cac067831796ffdaebd0070142fd356bb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 08eb488ed534825489e9034bdcb2e02c6da2b7de68ecf6f20b82e3ff43a405ea
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 11A14C71E01269DBDB24DF98CD84BDEB7B4BF14704F108AA9E509A3640DB30DA89CF61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA1080 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 214filememoryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 439 ca1080-ca10de CreateFileW 440 ca11dc 439->440 441 ca10e4-ca10fb ReadFile 439->441 444 ca11de-ca11f9 call cb1970 440->444 442 ca1101-ca1105 441->442 443 ca11d5-ca11d6 CloseHandle 441->443 442->443 446 ca110b-ca1114 442->446 443->440 446->443 448 ca111a-ca112c SetFilePointer 446->448 448->443 449 ca1132-ca1149 ReadFile 448->449 449->443 450 ca114f-ca1156 449->450 450->443 451 ca1158-ca1162 450->451 451->443 452 ca1164-ca116c 451->452 452->443 453 ca116e-ca1182 452->453 453->443 454 ca1184-ca11a7 GetFileSize VirtualAlloc 453->454 454->443 455 ca11a9-ca11c6 SetFilePointer ReadFile 454->455 456 ca11fa-ca122b FindCloseChangeNotification call ca1010 455->456 457 ca11c8-ca11cf VirtualFree 455->457 460 ca122e-ca123c 456->460 457->443 461 ca1242-ca1248 460->461 462 ca1316-ca1344 460->462 464 ca124e-ca1252 461->464 465 ca1327-ca132a 461->465 466 ca1346-ca134e VirtualFree 462->466 467 ca1354-ca1357 462->467 464->465 468 ca1258-ca1270 464->468 465->460 466->467 467->444 469 ca1276-ca1284 468->469 469->462 470 ca128a-ca1292 469->470 471 ca1298-ca129d 470->471 472 ca131f-ca1322 470->472 473 ca12aa-ca1313 call ca1010 * 2 call ca1360 471->473 474 ca129f-ca12a7 471->474 472->469 473->462 474->473
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,1798406C), ref: 00CA10D3
                                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,?,00000040,?,00000000), ref: 00CA10F7
                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,?,00000000,00000000), ref: 00CA1123
                                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,00000000,000000F8,00000040,00000000), ref: 00CA1145
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 00CA1187
                                                                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 00CA119A
                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00CA11B0
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,000000F8,000000F8,00000000), ref: 00CA11C2
                                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00CA11CF
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00CA11D6
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(00000000), ref: 00CA11FB
                                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00CA134E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$ReadVirtual$CloseFreePointer$AllocChangeCreateFindHandleNotificationSize
                                                                                                                                                                                                        • String ID: @$PE
                                                                                                                                                                                                        • API String ID: 1173161148-957972822
                                                                                                                                                                                                        • Opcode ID: f9e6cf258e24d5435ba442c92f09026ed0a5e5fc2f8bb53449c40f37691363c4
                                                                                                                                                                                                        • Instruction ID: 026e751e4a64ecf6cf7613fb477899174aba415ca1c431663ef2e9973700cbed
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f9e6cf258e24d5435ba442c92f09026ed0a5e5fc2f8bb53449c40f37691363c4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 61817071E403199BDF24CF55CC45BADB7B4FF4A714F188169EA19AB280EB705940CF64
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C891080 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 62libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 481 6c891080-6c891086 482 6c891088-6c891099 GetCurrentProcessId call 6c89a790 481->482 483 6c891106-6c89110a 481->483 489 6c8910a8-6c8910b3 LoadLibraryW 482->489 490 6c89109b-6c89109c call 6c89a800 482->490 484 6c89110c-6c891110 483->484 485 6c89111f-6c891122 483->485 484->485 488 6c891112-6c891116 484->488 488->485 491 6c891118-6c89111e 488->491 489->485 493 6c8910b5-6c8910ff GetProcAddress * 5 489->493 494 6c8910a1-6c8910a6 490->494 493->483 495 6c891101-6c891103 493->495 494->485 494->489 495->483
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,6C8F00F3), ref: 6C891088
                                                                                                                                                                                                          • Part of subcall function 6C89A790: CreateFileW.KERNELBASE ref: 6C89A7B0
                                                                                                                                                                                                        • LoadLibraryW.KERNELBASE(?,0000006C), ref: 6C8910A9
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,HttpInit), ref: 6C8910C1
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,HttpUninit), ref: 6C8910CE
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,zlib_uncompress), ref: 6C8910DB
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,zlib_compress), ref: 6C8910E8
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,zlib_compressBound), ref: 6C8910F5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressProc$CreateCurrentFileLibraryLoadProcess
                                                                                                                                                                                                        • String ID: HttpInit$HttpUninit$zlib_compress$zlib_compressBound$zlib_uncompress
                                                                                                                                                                                                        • API String ID: 3656772249-102961833
                                                                                                                                                                                                        • Opcode ID: 0b05ff2f0ba50db3d76e86b1e9ef2715cd1b40d1dfc477118c56289f0fafa778
                                                                                                                                                                                                        • Instruction ID: 23c002fb8e1152c290014448bb81f7106b75928f6aa50806c1493721a3859a9a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b05ff2f0ba50db3d76e86b1e9ef2715cd1b40d1dfc477118c56289f0fafa778
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C211FE70A04705ABD730AF7DD944B16F2F9AF94609B208C2EE496D3A50E774E085CA11
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C55F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 76COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 626 6c8c55f0-6c8c5619 627 6c8c561f-6c8c5628 626->627 628 6c8c5705-6c8c5711 626->628 644 6c8c5629 call 6c89c330 627->644 645 6c8c5629 call 6c89ee40 627->645 646 6c8c5629 call 6c891230 627->646 647 6c8c5629 call 6c8a73a0 627->647 648 6c8c5629 call 6c8c10f0 627->648 649 6c8c5629 call 6c8c12a0 627->649 650 6c8c5629 call 6c8c1480 627->650 629 6c8c563b-6c8c5651 call 6c908660 628->629 631 6c8c562b-6c8c562d 633 6c8c562f-6c8c5636 631->633 634 6c8c5654-6c8c565b 631->634 635 6c8c5638 633->635 636 6c8c5639 633->636 637 6c8c565d-6c8c5664 call 6c8d4070 634->637 638 6c8c5669-6c8c56cf call 6c90c210 GetModuleFileNameW PathRemoveFileSpecW PathAppendW GetPrivateProfileIntW 634->638 635->636 636->629 637->638 642 6c8c56ec-6c8c56ff GetPrivateProfileIntW 638->642 643 6c8c56d1-6c8c56e7 638->643 642->628 643->629 644->631 645->631 646->631 647->631 648->631 649->631 650->631
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8C5675
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,?,00000208), ref: 6C8C568D
                                                                                                                                                                                                        • PathRemoveFileSpecW.SHLWAPI(?), ref: 6C8C5698
                                                                                                                                                                                                        • PathAppendW.SHLWAPI(?,login.cfg), ref: 6C8C56A8
                                                                                                                                                                                                        • GetPrivateProfileIntW.KERNEL32(sina,disable_oauth2,00000000,?), ref: 6C8C56C5
                                                                                                                                                                                                        • GetPrivateProfileIntW.KERNEL32(sina,use_oauth2,00000001,?), ref: 6C8C56FD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FilePathPrivateProfile$AppendModuleNameRemoveSpec_memset
                                                                                                                                                                                                        • String ID: disable_oauth2$login.cfg$sina$use_oauth2
                                                                                                                                                                                                        • API String ID: 568257704-1840447276
                                                                                                                                                                                                        • Opcode ID: 36b7e95fb127dd1ccb1b627bb8fcc5af9672bc5d0fe30303026d03e12c0fa608
                                                                                                                                                                                                        • Instruction ID: d7ce7aa02be0373e5eb0621461e44d87343a1f1d170654923b458c6eb6a257fa
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 36b7e95fb127dd1ccb1b627bb8fcc5af9672bc5d0fe30303026d03e12c0fa608
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2F218275204705ABEB24DF25C944FD6B3F8AB94708F10CC2DE15983A80D7B0E488CB56
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA6DD0 Relevance: 15.1, APIs: 10, Instructions: 90COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 651 ca6dd0-ca6de2 652 ca6dee-ca6df3 651->652 653 ca6de4-ca6de9 DeleteObject 651->653 655 ca6dff-ca6e04 652->655 656 ca6df5-ca6dfa DeleteObject 652->656 653->652 654 ca6deb 653->654 654->652 657 ca6e10-ca6e15 655->657 658 ca6e06-ca6e0b DeleteObject 655->658 656->655 659 ca6dfc 656->659 661 ca6e21-ca6e26 657->661 662 ca6e17-ca6e1c DeleteObject 657->662 658->657 660 ca6e0d 658->660 659->655 660->657 664 ca6e28-ca6e2d DeleteObject 661->664 665 ca6e32-ca6e37 661->665 662->661 663 ca6e1e 662->663 663->661 664->665 666 ca6e2f 664->666 667 ca6e39-ca6e3e DeleteObject 665->667 668 ca6e43-ca6e48 665->668 666->665 667->668 669 ca6e40 667->669 670 ca6e4a-ca6e4f DeleteObject 668->670 671 ca6e54-ca6e59 668->671 669->668 670->671 674 ca6e51 670->674 672 ca6e5b-ca6e60 DeleteObject 671->672 673 ca6e65-ca6e6a 671->673 672->673 675 ca6e62 672->675 676 ca6e6c-ca6e71 DeleteObject 673->676 677 ca6e76-ca6e7a 673->677 674->671 675->673 676->677 678 ca6e73 676->678 679 ca6e7c-ca6e81 DeleteObject 677->679 680 ca6e85-ca6e88 677->680 678->677 679->680 681 ca6e83 679->681 681->680
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteObject
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1531683806-0
                                                                                                                                                                                                        • Opcode ID: 8bcf9b8675c6ec1800b33a3e25ee16648b32497fa8f1a6761941ce7e94a66176
                                                                                                                                                                                                        • Instruction ID: ed0fa1d4d6b71e388198e1d7032fbb1b34687d204ed0c96fe06505439792c0f5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8bcf9b8675c6ec1800b33a3e25ee16648b32497fa8f1a6761941ce7e94a66176
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9321E974B00B038BDA308FAECC94917F2EEAF9174432C4E19E5A5C3654EB71EE408B24
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8A8AA0 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 386synchronizationCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 682 6c8a8aa0-6c8a8b4b call 6c897a80 call 6c8a7210 WaitForSingleObject call 6c8d4a30 ReleaseMutex 689 6c8a8b4d-6c8a8b4e FindCloseChangeNotification 682->689 690 6c8a8b54-6c8a8b64 682->690 689->690 691 6c8a8b9e-6c8a8ba1 690->691 692 6c8a8b66-6c8a8b68 690->692 693 6c8a8ba3-6c8a8ba5 691->693 694 6c8a8bd6-6c8a8be2 691->694 695 6c8a8b6a-6c8a8b70 call 6c908655 692->695 696 6c8a8b73-6c8a8b99 call 6c908655 692->696 698 6c8a8bb0-6c8a8bd1 call 6c908655 693->698 699 6c8a8ba7-6c8a8bad call 6c908655 693->699 700 6c8a8be4-6c8a8bef call 6c908e84 694->700 701 6c8a8bf5-6c8a8bf7 694->701 695->696 711 6c8a8ff8-6c8a9013 call 6c908660 696->711 719 6c8a8ff6 698->719 699->698 700->701 703 6c8a8c00-6c8a8c04 701->703 709 6c8a8c0a-6c8a8c16 703->709 710 6c8a8f90-6c8a8f94 703->710 709->703 715 6c8a8c18-6c8a8c1c 709->715 717 6c8a8f9f-6c8a8fc0 call 6c908655 710->717 718 6c8a8f96-6c8a8f9c call 6c908655 710->718 715->710 720 6c8a8c22-6c8a8c28 715->720 717->719 729 6c8a8feb-6c8a8ff1 call 6c897ae0 717->729 718->717 719->711 720->710 724 6c8a8c2e-6c8a8c32 720->724 727 6c8a8c34-6c8a8c3f call 6c908e84 724->727 728 6c8a8c45-6c8a8c49 724->728 727->728 732 6c8a8c4b-6c8a8c4f 728->732 733 6c8a8c80-6c8a8c84 728->733 729->719 737 6c8a8c5a-6c8a8c7b call 6c908655 732->737 738 6c8a8c51-6c8a8c57 call 6c908655 732->738 734 6c8a8c86-6c8a8c91 call 6c908e84 733->734 735 6c8a8c97-6c8a8cb3 733->735 734->735 740 6c8a8cc6-6c8a8cde 735->740 741 6c8a8cb5-6c8a8cc0 call 6c908e84 735->741 737->719 738->737 746 6c8a8ceb-6c8a8cfc call 6c8e3360 740->746 747 6c8a8ce0-6c8a8ce5 call 6c908e84 740->747 741->740 755 6c8a8cfe-6c8a8d3f call 6c90c210 * 2 call 6c8e1ba0 746->755 756 6c8a8d75-6c8a8d95 746->756 747->746 773 6c8a8d41 call 6c908e84 755->773 774 6c8a8d46-6c8a8d66 call 6c8e20c0 755->774 758 6c8a8d9a-6c8a8dae call 6c8d47a0 756->758 759 6c8a8d97 756->759 765 6c8a8db1-6c8a8db5 758->765 759->758 767 6c8a8e6b-6c8a8e6e 765->767 768 6c8a8dbb-6c8a8dc7 765->768 771 6c8a8e7c-6c8a8e8c 767->771 772 6c8a8e70-6c8a8e79 call 6c908655 767->772 768->765 770 6c8a8dc9-6c8a8df7 call 6c8fca10 call 6c89a020 768->770 789 6c8a8df9 770->789 790 6c8a8dff-6c8a8e21 call 6c8fcb10 770->790 777 6c8a8e94-6c8a8eaa call 6c901210 call 6c900830 771->777 772->771 773->774 774->756 787 6c8a8d68-6c8a8d70 call 6c89a760 774->787 795 6c8a8f2a-6c8a8f38 call 6c894f10 777->795 796 6c8a8eac-6c8a8eb6 777->796 787->729 789->790 790->777 801 6c8a8e23-6c8a8e31 call 6c894f10 790->801 808 6c8a8f3a-6c8a8f43 call 6c908655 795->808 809 6c8a8f46-6c8a8f5d 795->809 798 6c8a8eb8-6c8a8ede call 6c902500 796->798 799 6c8a8ee0 796->799 804 6c8a8ee2-6c8a8ef0 call 6c894f10 798->804 799->804 811 6c8a8e3f-6c8a8e54 801->811 812 6c8a8e33-6c8a8e3c call 6c908655 801->812 822 6c8a8efe-6c8a8f13 804->822 823 6c8a8ef2-6c8a8efb call 6c908655 804->823 808->809 815 6c8a8f68-6c8a8f8e call 6c908655 809->815 816 6c8a8f5f-6c8a8f65 call 6c908655 809->816 819 6c8a8e5f-6c8a8e65 811->819 820 6c8a8e56-6c8a8e5c call 6c908655 811->820 812->811 815->711 816->815 819->767 820->819 825 6c8a8f1e-6c8a8f24 822->825 826 6c8a8f15-6c8a8f1b call 6c908655 822->826 823->822 825->795 826->825
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C8A7210: CreateMutexW.KERNELBASE(00000000,00000000,?,ECBB529E,?,00000000,6C937BC8,000000FF,6C8C1EE3), ref: 6C8A724C
                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,?,Local\360_login_account_config_lock2,?,ECBB529E,?,?,00000000), ref: 6C8A8B0F
                                                                                                                                                                                                          • Part of subcall function 6C8D4A30: CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000000,00000000,?,?,?,?,?,?,6C8A8B2A), ref: 6C8D4A4B
                                                                                                                                                                                                          • Part of subcall function 6C8D4A30: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,6C8A8B2A), ref: 6C8D4A5E
                                                                                                                                                                                                          • Part of subcall function 6C8D4A30: CloseHandle.KERNEL32(00000000,?,?,?,?,6C8A8B2A), ref: 6C8D4A6D
                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 6C8A8B38
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(?), ref: 6C8A8B4E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCreateFileMutex$ChangeFindHandleNotificationObjectReleaseSingleSizeWait
                                                                                                                                                                                                        • String ID: 360LOGINDATA$Local\360_login_account_config_lock2$ver
                                                                                                                                                                                                        • API String ID: 3647123575-2962277479
                                                                                                                                                                                                        • Opcode ID: 9d6efa4ad0445fc1c2a3e732673e6eb7cd3d78aa8656e2a789783d34d53e1471
                                                                                                                                                                                                        • Instruction ID: fc49711a373311aeb149edbb28986c31b49921226a62eb6900200647bcf86217
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d6efa4ad0445fc1c2a3e732673e6eb7cd3d78aa8656e2a789783d34d53e1471
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A1E187B1E00199DBDB24CF98C984BDDB775AF58304F1589AAD40AB7740D7309A89CF61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C89C330 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 384COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 836 6c89c330-6c89c37e 837 6c89c38a-6c89c3ed call 6c90c210 SHGetValueW PathAppendW call 6c89a800 836->837 838 6c89c380-6c89c385 836->838 845 6c89c3f2-6c89c3fb 837->845 839 6c89c7ef-6c89c812 call 6c908660 838->839 846 6c89c3fd-6c89c418 call 6c897530 call 6c89ee40 845->846 847 6c89c41f-6c89c426 call 6c89f320 845->847 846->847 858 6c89c41a 846->858 852 6c89c428-6c89c42a 847->852 853 6c89c42c-6c89c42e 847->853 852->853 855 6c89c494-6c89c49e call 6c8c12a0 852->855 853->855 856 6c89c430-6c89c45d call 6c891230 853->856 862 6c89c4a0-6c89c4a2 call 6c8c1480 855->862 863 6c89c4a7-6c89c527 call 6c89c080 call 6c8a73a0 call 6c897a80 call 6c8c2da0 call 6c897a80 call 6c8a7420 855->863 868 6c89c469-6c89c488 856->868 869 6c89c45f-6c89c464 call 6c89ef80 856->869 858->847 862->863 884 6c89c529 call 6c908e84 863->884 885 6c89c52e-6c89c53a 863->885 868->855 872 6c89c48a-6c89c48f 868->872 869->868 872->855 884->885 887 6c89c540-6c89c548 885->887 888 6c89c54a call 6c908e84 887->888 889 6c89c54f-6c89c551 887->889 888->889 891 6c89c559 call 6c908e84 889->891 892 6c89c553-6c89c557 889->892 893 6c89c55e-6c89c560 891->893 892->891 892->893 895 6c89c728-6c89c73c 893->895 896 6c89c566-6c89c568 893->896 899 6c89c73e-6c89c744 895->899 900 6c89c761-6c89c782 call 6c908655 895->900 897 6c89c56e-6c89c573 call 6c908e84 896->897 898 6c89c650-6c89c652 896->898 903 6c89c575-6c89c578 897->903 898->903 904 6c89c754-6c89c75e call 6c908655 899->904 905 6c89c746-6c89c752 call 6c89cc80 899->905 913 6c89c7a9-6c89c7e1 call 6c908655 900->913 914 6c89c784-6c89c78a 900->914 909 6c89c57a call 6c908e84 903->909 910 6c89c57f-6c89c58e call 6c89dba0 903->910 904->900 905->904 909->910 924 6c89c6eb-6c89c6f1 910->924 925 6c89c594-6c89c59e 910->925 929 6c89c7ed 913->929 930 6c89c7e3-6c89c7e8 913->930 918 6c89c78c 914->918 919 6c89c7a0-6c89c7a6 call 6c908655 914->919 923 6c89c790-6c89c79a call 6c895c70 918->923 919->913 943 6c89c79c 923->943 927 6c89c71a-6c89c71c 924->927 928 6c89c6f3-6c89c6f8 call 6c908e84 924->928 932 6c89c5a9-6c89c5ad 925->932 933 6c89c5a0-6c89c5a5 call 6c908e84 925->933 936 6c89c6fa-6c89c701 927->936 928->936 929->839 930->929 939 6c89c5b0-6c89c5b6 932->939 933->932 941 6c89c708-6c89c715 936->941 942 6c89c703 call 6c908e84 936->942 945 6c89c5b8 call 6c908e84 939->945 946 6c89c5bd-6c89c5bf 939->946 941->887 942->941 943->919 945->946 948 6c89c5c1-6c89c5c5 946->948 949 6c89c5c7 call 6c908e84 946->949 948->949 951 6c89c5cc-6c89c5ce 948->951 949->951 953 6c89c693-6c89c69f 951->953 954 6c89c5d4-6c89c5d6 951->954 955 6c89c6a9-6c89c6ae 953->955 956 6c89c6a1-6c89c6a3 953->956 957 6c89c5d8-6c89c5dd call 6c908e84 954->957 958 6c89c657-6c89c659 954->958 959 6c89c6b1-6c89c6bd 955->959 956->959 960 6c89c5df-6c89c5e2 957->960 958->960 962 6c89c6cd-6c89c6cf 959->962 963 6c89c6bf-6c89c6cb 959->963 965 6c89c5e9-6c89c5f8 960->965 966 6c89c5e4 call 6c908e84 960->966 967 6c89c6d1 call 6c908e84 962->967 968 6c89c6d6-6c89c6e6 call 6c8a06b0 962->968 963->924 973 6c89c5fa-6c89c5fc 965->973 974 6c89c62f-6c89c631 965->974 966->965 967->968 968->924 975 6c89c65b-6c89c65d 973->975 976 6c89c5fe-6c89c603 call 6c908e84 973->976 977 6c89c65f-6c89c661 974->977 978 6c89c633-6c89c638 call 6c908e84 974->978 980 6c89c605-6c89c608 975->980 976->980 981 6c89c63a-6c89c63d 977->981 978->981 987 6c89c60a call 6c908e84 980->987 988 6c89c60f-6c89c619 980->988 984 6c89c63f call 6c908e84 981->984 985 6c89c644-6c89c64b 981->985 984->985 985->939 987->988 992 6c89c61f-6c89c62d call 6c908c33 988->992 993 6c89c71e-6c89c723 call 6c89a4e0 988->993 992->974 997 6c89c663-6c89c665 992->997 993->895 998 6c89c6a5-6c89c6a7 997->998 999 6c89c667-6c89c66c call 6c908e84 997->999 1000 6c89c66e-6c89c671 998->1000 999->1000 1003 6c89c678-6c89c68e call 6c89f770 1000->1003 1004 6c89c673 call 6c908e84 1000->1004 1003->953 1004->1003
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AppendPathValue_memset
                                                                                                                                                                                                        • String ID: ,$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe$\Bin\360Login.dll
                                                                                                                                                                                                        • API String ID: 3861306846-3845051458
                                                                                                                                                                                                        • Opcode ID: 6358d33855f9a587ed4c04ba7c6e7fb48d2f8608e3bb631d07d2c68c51703e11
                                                                                                                                                                                                        • Instruction ID: 87931a3148d75538516251d7d0a2adaaa58b02bb1b6ca427aa8f7aa23cf1a1c5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6358d33855f9a587ed4c04ba7c6e7fb48d2f8608e3bb631d07d2c68c51703e11
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AEE19D726083419BD764EF6CCA8099FB7E5BF94308F144E2DE9558BB41DB31E809CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAD0B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 140libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1008 cad0b0-cad12f call cb1510 GetModuleFileNameW PathRemoveFileSpecW PathAppendW 1012 cad130-cad139 1008->1012 1012->1012 1013 cad13b-cad15d call ca5b40 call ca1000 1012->1013 1018 cad15f-cad16f 1013->1018 1019 cad194-cad19d LoadLibraryW 1013->1019 1022 cad17b-cad193 call cb1970 1018->1022 1023 cad171-cad176 1018->1023 1020 cad19f-cad1ad GetProcAddress 1019->1020 1021 cad1e7-cad1ed 1019->1021 1020->1021 1027 cad1af-cad1b8 1020->1027 1025 cad20b-cad21b 1021->1025 1026 cad1ef-cad203 1021->1026 1023->1022 1029 cad21d-cad222 1025->1029 1030 cad227-cad23f call cb1970 1025->1030 1026->1025 1027->1021 1034 cad1ba-cad1c0 1027->1034 1029->1030 1034->1025 1037 cad1c2-cad1cc 1034->1037 1037->1021 1039 cad1ce-cad1dc 1037->1039 1041 cad1de-cad1e0 1039->1041 1042 cad1e2 1039->1042 1041->1021 1042->1021
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAD0F4
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000207), ref: 00CAD107
                                                                                                                                                                                                        • PathRemoveFileSpecW.SHLWAPI(?), ref: 00CAD112
                                                                                                                                                                                                        • PathAppendW.SHLWAPI(?,360Login.dll), ref: 00CAD122
                                                                                                                                                                                                        • LoadLibraryW.KERNELBASE(?,?), ref: 00CAD195
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,LoginGetModuleW), ref: 00CAD1A5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FilePath$AddressAppendLibraryLoadModuleNameProcRemoveSpec_memset
                                                                                                                                                                                                        • String ID: 360Login.dll$LoginGetModuleW
                                                                                                                                                                                                        • API String ID: 4215116772-1645343665
                                                                                                                                                                                                        • Opcode ID: 1af2438ed22a09dec9eb2f69046b6ccc0f4acbb39d77196c57c6955a2f8cfb19
                                                                                                                                                                                                        • Instruction ID: f9503369b41a97aeea0b4c15dc4477e2f217d7468936f2ae33bed86f57b6144a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1af2438ed22a09dec9eb2f69046b6ccc0f4acbb39d77196c57c6955a2f8cfb19
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0414CB56046029FD314DF68DC91EAB73E9BF89318F04892CE556C7261EB34E905CB91
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C920160 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1043 6c920160-6c92017e 1044 6c920184-6c920187 1043->1044 1045 6c9202dd-6c9202f4 call 6c908660 1043->1045 1044->1045 1047 6c92018d-6c9201dd call 6c90c210 SHGetValueA 1044->1047 1047->1045 1051 6c9201e3-6c9201ed 1047->1051 1052 6c9201f0-6c9201f5 1051->1052 1052->1052 1053 6c9201f7-6c9201fc 1052->1053 1053->1045 1054 6c920202-6c920214 1053->1054 1055 6c920216-6c92021b 1054->1055 1056 6c92022e-6c920230 1055->1056 1057 6c92021d-6c920222 1055->1057 1059 6c920232 1056->1059 1060 6c920233-6c92024d 1056->1060 1057->1056 1058 6c920224-6c92022a 1057->1058 1058->1055 1061 6c92022c 1058->1061 1059->1060 1062 6c920250-6c920258 1060->1062 1061->1059 1063 6c92025a-6c92025f 1062->1063 1064 6c92026b-6c92026d 1062->1064 1063->1064 1065 6c920261-6c920267 1063->1065 1066 6c920270-6c9202b4 call 6c90c210 call 6c91f350 lstrcmpiA 1064->1066 1067 6c92026f 1064->1067 1065->1062 1069 6c920269 1065->1069 1066->1045 1073 6c9202b6-6c9202dc call 6c91f1f0 call 6c908660 1066->1073 1067->1066 1069->1067
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C9201AC
                                                                                                                                                                                                        • SHGetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,?,?,?,?,00000400), ref: 6C9201D5
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C920282
                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,?), ref: 6C9202AA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$Valuelstrcmpi
                                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                                        • API String ID: 999496690-2395435937
                                                                                                                                                                                                        • Opcode ID: 07ac2d43152311bf2feac61e153119b2122619f94e116f54b686fbdf531eafe7
                                                                                                                                                                                                        • Instruction ID: 1f252953253dd7a2d8c94981d4435f6f3587ca0e2c9e428d0ad0332141fd0f50
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 07ac2d43152311bf2feac61e153119b2122619f94e116f54b686fbdf531eafe7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 944124316187C98FD725CB24C860BEB77E8AB9270CF04491ED9CA87945E734D508CB52
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8D4C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8D4C9A
                                                                                                                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,?,?,?,6C8E2797), ref: 6C8D4CA8
                                                                                                                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,?,?,?,6C8E2797), ref: 6C8D4CC9
                                                                                                                                                                                                        • VerQueryValueW.VERSION(?,6C94B750,?,?,?,00000000,00000000,?,?,?,?,?,6C8E2797), ref: 6C8D4CE6
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8D4CF7
                                                                                                                                                                                                          • Part of subcall function 6C8D50B0: _vswprintf_s.LIBCMT ref: 6C8D50E6
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileInfoVersion_memset$QuerySizeValue_vswprintf_s
                                                                                                                                                                                                        • String ID: %d.%d.%d.%d
                                                                                                                                                                                                        • API String ID: 3774703460-3491811756
                                                                                                                                                                                                        • Opcode ID: 8040a8bfb9c174bf70df472bd168d398edefcd23fb11f37be077166f2cc82dc5
                                                                                                                                                                                                        • Instruction ID: a81f531a5eefefaf19f424fb6b5b85c90e0b500f34169b55390e270a95fe1c0c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8040a8bfb9c174bf70df472bd168d398edefcd23fb11f37be077166f2cc82dc5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C61184B56043006EE714CB60CC45FBF73E8DFE4704F418C2DBA4996A90EB34E5449766
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C891230 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C891259
                                                                                                                                                                                                        • SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,?,?), ref: 6C89126C
                                                                                                                                                                                                        • PathFileExistsW.KERNELBASE(00000000,?,?,?,?,?,?), ref: 6C8912AB
                                                                                                                                                                                                        • SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?,?,?,?,?,?), ref: 6C8912BA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Path$CreateDirectoryExistsFileFolderSpecial_memset
                                                                                                                                                                                                        • String ID: %s\%s$360Login
                                                                                                                                                                                                        • API String ID: 1222218533-4210783814
                                                                                                                                                                                                        • Opcode ID: 4247c6166398bd7ce4b05a1edcc7090615e603690f472edcc909234714907f90
                                                                                                                                                                                                        • Instruction ID: 652a2ba9f10f0c64bd11837fac0bc6d3aabc032f35bbc78ea9c387d664eba271
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4247c6166398bd7ce4b05a1edcc7090615e603690f472edcc909234714907f90
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D1108B17082446FE724DBA8D805BAB73B8AFD4B08F504D3DA909C6680E770C544865B
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C12A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00A00000,360_test,00000000,?,6C89C49C,?), ref: 6C8C12C5
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 6C8C12D3
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 6C8C1113
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,00000000,?,?,6C8C1F61,?), ref: 6C8C1130
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: SetSecurityInfo.ADVAPI32(?,00000006,00000010,00000000,00000000,00000000,?,?,?,6C8C1F61,?), ref: 6C8C114B
                                                                                                                                                                                                          • Part of subcall function 6C8C10F0: LocalFree.KERNEL32(?,?,?,6C8C1F61,?), ref: 6C8C115B
                                                                                                                                                                                                        • CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00A00000,360Login_filemapping), ref: 6C8C12F6
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 6C8C12FF
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Security$Descriptor$CreateErrorFileLastMapping$ConvertFreeInfoLocalSaclString
                                                                                                                                                                                                        • String ID: 360Login_filemapping$360_test
                                                                                                                                                                                                        • API String ID: 3010624172-1279699294
                                                                                                                                                                                                        • Opcode ID: 38997f331b5d5d83fd0c95e4dbc551687859763b95d1651b004fb33ba36526af
                                                                                                                                                                                                        • Instruction ID: e8d394b14464e6d2dff6fe394b1b127f7e52dba626d194b593748e9fca437f99
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 38997f331b5d5d83fd0c95e4dbc551687859763b95d1651b004fb33ba36526af
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71014474344701AAE7706B76CE81B15B2E4AF41B2DF344E29A175D7DC0D6B8E080C616
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAC8B0 Relevance: 9.1, APIs: 6, Instructions: 80fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CABE80: _memset.LIBCMT ref: 00CABEAE
                                                                                                                                                                                                          • Part of subcall function 00CABE80: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CABED8
                                                                                                                                                                                                        • PathFileExistsW.KERNELBASE(?), ref: 00CAC8CD
                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00CAC8E9
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 00CAC8FD
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAC918
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00CAC92A
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00CAC93C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Path_memset$CloseCreateExistsFolderHandleReadSize
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3529084245-0
                                                                                                                                                                                                        • Opcode ID: 30a119a1a8168e641b5acc9060d87f10d7ed64842622f6409f77268d6b2ffd94
                                                                                                                                                                                                        • Instruction ID: 5de998bd10b69434744ea681b9cc9b9ba89b2d1cd0a51fb935d9f019b1cd331d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 30a119a1a8168e641b5acc9060d87f10d7ed64842622f6409f77268d6b2ffd94
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 84213A711003027FD220AB35DCC9FAF3BADEFC6764F048618F92656192EB31A909C6B1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C927D00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,6C927F77,?,?,?,00000CB4,?,?,00000000,00000000,00000CB4,00000040), ref: 6C927D0F
                                                                                                                                                                                                        • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?,00004000), ref: 6C927D42
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$PointerRead
                                                                                                                                                                                                        • String ID: .\QHImageHlp.c$ReadFile()$SetFilePointerEx()
                                                                                                                                                                                                        • API String ID: 3154509469-2897820174
                                                                                                                                                                                                        • Opcode ID: c5e3197b194873faa9efaca0d50cc58048b246765a67c1c3103ef99db0d9118e
                                                                                                                                                                                                        • Instruction ID: 41b1fd18723d965546fd6c2295dfbf706d48dedb6325359f05f1e732160c00fd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c5e3197b194873faa9efaca0d50cc58048b246765a67c1c3103ef99db0d9118e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5E01C2B43942023BF3106BA0CC46F7B32ACDBD1B0AF40CD45B584E9E98FAA4E8005662
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C10F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 6C8C1113
                                                                                                                                                                                                        • GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,00000000,?,?,6C8C1F61,?), ref: 6C8C1130
                                                                                                                                                                                                        • SetSecurityInfo.ADVAPI32(?,00000006,00000010,00000000,00000000,00000000,?,?,?,6C8C1F61,?), ref: 6C8C114B
                                                                                                                                                                                                        • LocalFree.KERNEL32(?,?,?,6C8C1F61,?), ref: 6C8C115B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Security$Descriptor$ConvertFreeInfoLocalSaclString
                                                                                                                                                                                                        • String ID: S:(ML;;NW;;;LW)
                                                                                                                                                                                                        • API String ID: 3116297227-495562761
                                                                                                                                                                                                        • Opcode ID: 8c3034810d76cc73568c0899262262cf9d8dde431217fc580d1cdc3fb041aa0e
                                                                                                                                                                                                        • Instruction ID: ac7965fc972734f54ca6e60f1cd8e5d76cd2e5c6a1e0e6a02835f2775ef7071d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c3034810d76cc73568c0899262262cf9d8dde431217fc580d1cdc3fb041aa0e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A017CB5208301AFE710DF64CCC4EABBBEDFB88648F008C1DB59582290D635D908CB62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA6D60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CA6D86
                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(00000104,00000104), ref: 00CA6D98
                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\Fonts\msyh.ttf), ref: 00CA6DA8
                                                                                                                                                                                                        • PathFileExistsW.KERNELBASE ref: 00CA6DB2
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DirectoryExistsFilePathWindows_memsetlstrcat
                                                                                                                                                                                                        • String ID: \Fonts\msyh.ttf
                                                                                                                                                                                                        • API String ID: 2149854892-1699844292
                                                                                                                                                                                                        • Opcode ID: b7238ca4c3a55a81123e377ff391f749279d3849a1aa6470b48cf9c5eb0c1533
                                                                                                                                                                                                        • Instruction ID: 30feafab97148b0109472afb44162df562539e4bf3a7cc27055e0361fc9c7429
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b7238ca4c3a55a81123e377ff391f749279d3849a1aa6470b48cf9c5eb0c1533
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EDF082B5544300ABC314EB60EC5AF9F77E4EF88700F41891CF5AA82192EA349008CB52
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8D4A30 Relevance: 7.6, APIs: 5, Instructions: 70fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000000,00000000,?,?,?,?,?,?,6C8A8B2A), ref: 6C8D4A4B
                                                                                                                                                                                                        • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,6C8A8B2A), ref: 6C8D4A5E
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,6C8A8B2A), ref: 6C8D4A6D
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,6C8A8B2A), ref: 6C8D4AAD
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,6C8A8B2A), ref: 6C8D4ACD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$CloseHandle$CreateReadSize
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3664964396-0
                                                                                                                                                                                                        • Opcode ID: 85fdea544fc9a88ca5ddbaa7356793f48ecda63f424306a45536ced9358c12d2
                                                                                                                                                                                                        • Instruction ID: debbb6611185147bb1735278a9d3adb8a2ca3439c95f55cf0c5dd182f64a2a45
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 85fdea544fc9a88ca5ddbaa7356793f48ecda63f424306a45536ced9358c12d2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AB11E4313042159FC718EF58CC88A6F77B9FBC5218F6A8A6DF814D7244D730E5098BA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C908E94 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __lock.LIBCMT ref: 6C908EB2
                                                                                                                                                                                                          • Part of subcall function 6C91151F: __mtinitlocknum.LIBCMT ref: 6C911535
                                                                                                                                                                                                          • Part of subcall function 6C91151F: __amsg_exit.LIBCMT ref: 6C911541
                                                                                                                                                                                                          • Part of subcall function 6C91151F: EnterCriticalSection.KERNEL32(?,?,?,6C912097,00000004,6C953CE0,0000000C,6C90EA00,00000000,?,00000000,00000000,00000000,?,6C910012,00000001), ref: 6C911549
                                                                                                                                                                                                        • ___sbh_find_block.LIBCMT ref: 6C908EBD
                                                                                                                                                                                                        • ___sbh_free_block.LIBCMT ref: 6C908ECC
                                                                                                                                                                                                        • RtlFreeHeap.NTDLL(00000000,00000000,6C9537C8,0000000C,6C911500,00000000,6C953CC0,0000000C,6C91153A,00000000,?,?,6C912097,00000004,6C953CE0,0000000C), ref: 6C908EFC
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,6C912097,00000004,6C953CE0,0000000C,6C90EA00,00000000,?,00000000,00000000,00000000,?,6C910012,00000001,00000214), ref: 6C908F0D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2714421763-0
                                                                                                                                                                                                        • Opcode ID: ff841324dc8f98654aa0d85c8694467d73cb038430577de0afff05439095bea7
                                                                                                                                                                                                        • Instruction ID: 75a0bdab1acc06350661393af8bdf2f5cff3c56e4d0e566c7aa3fa75ee8a56ce
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff841324dc8f98654aa0d85c8694467d73cb038430577de0afff05439095bea7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F6014431B49215AADF186FB5980979E3B78AF3276CF20415EE501ABEC0DB34C6448B99
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C89A790 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNELBASE ref: 6C89A7B0
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,0022204C,00000000,00000004,00000000,00000004,00000003,00000000), ref: 6C89A7E0
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 6C89A7E9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                        • String ID: \\.\360SelfProtection
                                                                                                                                                                                                        • API String ID: 33631002-936859468
                                                                                                                                                                                                        • Opcode ID: 667dcce0b62af62dd9fd6edac81974f8e46f5a8feffa60b39da231e4febae50e
                                                                                                                                                                                                        • Instruction ID: e8182bb45b72555e6ab2ee76708e754b3060aa3eed36346ee34f1bb3441bb4ed
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 667dcce0b62af62dd9fd6edac81974f8e46f5a8feffa60b39da231e4febae50e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24F0C83138431076E714EA68EC0AFD736B4BB85F15F444A14F754D61C0D3B4960CC6A2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CABE80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CABEAE
                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CABED8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath_memset
                                                                                                                                                                                                        • String ID: %s\%s\loopinfo.xml$360Desktop
                                                                                                                                                                                                        • API String ID: 3318179493-2372790096
                                                                                                                                                                                                        • Opcode ID: ffdf9786011789e7d7d5370b9674f312f3ac020ec61b3576f963e63fb5cee108
                                                                                                                                                                                                        • Instruction ID: 21b6fd24daab5858456a8ec6a9709df5c031686c077526b0f3de6f89659980bc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ffdf9786011789e7d7d5370b9674f312f3ac020ec61b3576f963e63fb5cee108
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C01D6716403006BE3249B98DC56FAB7390EF94700F84491CF5898B282EA70A50487DA
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C89EE40 Relevance: 6.1, APIs: 4, Instructions: 105COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,?,?,?,?,?,?,?,?,?,?,6C93FBBC,000000FF), ref: 6C89EEB7
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C89EF01
                                                                                                                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C89EF12
                                                                                                                                                                                                        • VerQueryValueW.VERSION(00000000,6C94B750,?,?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C89EF27
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileInfoVersion$QuerySizeValue_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3017621270-0
                                                                                                                                                                                                        • Opcode ID: 4f3902f4f41f024484dc00acc72a09030f3dfdee72a34aa81f9e00f508f78107
                                                                                                                                                                                                        • Instruction ID: 4f181bf7d0442fc5de083ff7475b74cb41fdcf1c9a6719763063a1321e749919
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f3902f4f41f024484dc00acc72a09030f3dfdee72a34aa81f9e00f508f78107
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56315571204B419BD314CB2CC844B5ABBA5FBD6338F148B1DF4A99B6E0D734D905CB95
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C926830 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • TlsFree.KERNELBASE(?), ref: 6C92683C
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6C926849
                                                                                                                                                                                                        • GetProcessHeap.KERNEL32 ref: 6C92685E
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,00000000), ref: 6C92686C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeHeap$CloseHandleProcess
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 54015191-0
                                                                                                                                                                                                        • Opcode ID: 7107d236bbd5fd55d1d87eeef37404d68f29f718774b9e6cf8db0e11d46d8b3f
                                                                                                                                                                                                        • Instruction ID: adbc2c292c62a9e2dc868cfb14b7e2ab9c2e9a9b46c7d6526af0b1a6afe3e618
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7107d236bbd5fd55d1d87eeef37404d68f29f718774b9e6cf8db0e11d46d8b3f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1FE06D3131965257DB28AA34C85CB577BFCAF0275CB208968B9E9C2994CB38E885C620
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C11F0 Relevance: 4.6, APIs: 3, Instructions: 54COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(?,ECBB529E,?,?,?,6C93C7B6,000000FF,6C89C282,?), ref: 6C8C122B
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,ECBB529E,?,?,?,6C93C7B6,000000FF,6C89C282,?), ref: 6C8C123B
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(0000000E,ECBB529E,?,?,?,6C93C7B6,000000FF,6C89C282,?), ref: 6C8C127B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$ChangeCriticalDeleteFindHandleNotificationSection
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2515036776-0
                                                                                                                                                                                                        • Opcode ID: 190ca797aa08abab681439d3c76d522766cf82b0d443327c409351f808610405
                                                                                                                                                                                                        • Instruction ID: bf9128d70799a3f92301e9e8b7e6bd840bc8f457c2447eebe5f91d354ee0395f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 190ca797aa08abab681439d3c76d522766cf82b0d443327c409351f808610405
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0F112675204A418FD314CF29C984B57F7F8EF95724F108A1DE4AA87AA0DB34E804CAA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CBC784 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(00000000,00CB399B), ref: 00CBC787
                                                                                                                                                                                                        • __malloc_crt.LIBCMT ref: 00CBC7B5
                                                                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CBC7C2
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EnvironmentStrings$Free__malloc_crt
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 237123855-0
                                                                                                                                                                                                        • Opcode ID: afb9f1a8d8052f586250d28919ddc740e85f2e225fb2b2ac082018589a73a469
                                                                                                                                                                                                        • Instruction ID: 46decac0d0397f221c08aa62c3cf47cb24ab672cf8e9cf7d7b8609c3a6030191
                                                                                                                                                                                                        • Opcode Fuzzy Hash: afb9f1a8d8052f586250d28919ddc740e85f2e225fb2b2ac082018589a73a469
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0BF027375040206E9B2476747CC88FB1739DAC63297165465F8B3D3100FF604E829AA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C5EB0 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8C5ED6
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00000104,00000104), ref: 6C8C5EEA
                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32 ref: 6C8C5EF0
                                                                                                                                                                                                          • Part of subcall function 6C89A790: CreateFileW.KERNELBASE ref: 6C89A7B0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$CreateCurrentModuleNameProcess_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3526627467-0
                                                                                                                                                                                                        • Opcode ID: ef53da39a36a1ced9efbf3110275e0b64a702deb66e6e7f0713e1cb17292b8b3
                                                                                                                                                                                                        • Instruction ID: d1852417cdece32175e50d7799cd06c306de026d4f037ab4ff6ce9447969d6d4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef53da39a36a1ced9efbf3110275e0b64a702deb66e6e7f0713e1cb17292b8b3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D7F0A9B5B143405BDB18AB64D84EBEB33B4AFA4708F40482DA45AC7681EA34D1188757
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C940980 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 7libraryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryW.KERNELBASE(psapi.dll), ref: 6C940985
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LibraryLoad
                                                                                                                                                                                                        • String ID: psapi.dll
                                                                                                                                                                                                        • API String ID: 1029625771-80456845
                                                                                                                                                                                                        • Opcode ID: d476910c6358229fb3219919c7bb331cd0a888323e3f89d4c1adf37d2c861456
                                                                                                                                                                                                        • Instruction ID: bd107598b7024604a2490a13a6a8a3a55bb8aa750cd9cd81501861d2feda307d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d476910c6358229fb3219919c7bb331cd0a888323e3f89d4c1adf37d2c861456
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1FB01277B0870046CF082FB0981CC493A30B793A09330885DE113C6F94CF30C09087C8
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8D3F40 Relevance: 3.1, APIs: 2, Instructions: 111COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(?,ECBB529E,?,?,?,?,6C937C94,000000FF,6C8C53E2,?,ECBB529E,?,?,?,6C93D2FB,000000FF), ref: 6C8D3F94
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,ECBB529E,?,?,?,?,6C937C94,000000FF,6C8C53E2,?,ECBB529E,?,?,?,6C93D2FB,000000FF), ref: 6C8D404C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3664257935-0
                                                                                                                                                                                                        • Opcode ID: 6544ac08463f70f536ccf608ed672295e4b964f106ea50d324d86b6977a360ce
                                                                                                                                                                                                        • Instruction ID: 92b61337d248d0005c57672e1783d12c22204e2ed79dc38ca126b48b4f374f90
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6544ac08463f70f536ccf608ed672295e4b964f106ea50d324d86b6977a360ce
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF412BB1204B428FD354CF6DC980A16B7E5FFD9224B258A6DE0AAC76A1C731E905CB90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C929290 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 6C929296
                                                                                                                                                                                                          • Part of subcall function 6C90BC42: __FF_MSGBANNER.LIBCMT ref: 6C90BC65
                                                                                                                                                                                                          • Part of subcall function 6C90BC42: __NMSG_WRITE.LIBCMT ref: 6C90BC6C
                                                                                                                                                                                                          • Part of subcall function 6C90BC42: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,?,?,6C92929B,?,?,6C921C72,00002000,ECBB529E,?,00000000,?,ECBB529E), ref: 6C90BCB9
                                                                                                                                                                                                        • SetLastError.KERNEL32(00000008,?,ECBB529E,?,?,?,?,?,?,?,?,?,?,?,00000000,6C937908), ref: 6C9292A6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocateErrorHeapLast_malloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3224363687-0
                                                                                                                                                                                                        • Opcode ID: f6b4a06696d6de98a53bfe5b06a9c7ff43af0c1b7a47322beed309193a545a26
                                                                                                                                                                                                        • Instruction ID: c36ef485f5f2d1703ca70ff65db683695afa52428c8e3b962bc9fbdcd94148af
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f6b4a06696d6de98a53bfe5b06a9c7ff43af0c1b7a47322beed309193a545a26
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5AC08032B4853017C7141298690968735A86F50674F064110FDC4DB700C724CC0583D1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB99BB Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___crtCorExitProcess.LIBCMT ref: 00CB99C3
                                                                                                                                                                                                          • Part of subcall function 00CB9990: GetModuleHandleW.KERNEL32(mscoree.dll,?,00CB99C8,?,?,00CB617F,000000FF,0000001E,00CCA330,0000000C,00CB622B,?,?,?,00CBE303,00000004), ref: 00CB999A
                                                                                                                                                                                                          • Part of subcall function 00CB9990: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CB99AA
                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00CB99CC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2427264223-0
                                                                                                                                                                                                        • Opcode ID: 600ae4a19946d1c71c3f2cc288c0f149f81a44dc1fb731d4dc60a0557d775049
                                                                                                                                                                                                        • Instruction ID: 71659c56d8b4a8fdfa0b16294a1780d15cdb64bf769f8460c29498e9d5f1a45d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 600ae4a19946d1c71c3f2cc288c0f149f81a44dc1fb731d4dc60a0557d775049
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 47B09231400208BBDB052F12DC0AD8D3F2AEB813A0B108024FA180A071DF72AD92EA85
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8A7210 Relevance: 1.5, APIs: 1, Instructions: 29synchronizationCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateMutexW.KERNELBASE(00000000,00000000,?,ECBB529E,?,00000000,6C937BC8,000000FF,6C8C1EE3), ref: 6C8A724C
                                                                                                                                                                                                          • Part of subcall function 6C899CC0: GetLastError.KERNEL32(6C898589), ref: 6C899CC0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateErrorLastMutex
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1925916568-0
                                                                                                                                                                                                        • Opcode ID: bd12f1a54d1d7c1196af779da1ffa09d6bb248e6f36d5df2c6ea53f8e7a41135
                                                                                                                                                                                                        • Instruction ID: d781dfac1f16c08e1e7637903b767b18f380c6c76e19f92006641cf004bbc185
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd12f1a54d1d7c1196af779da1ffa09d6bb248e6f36d5df2c6ea53f8e7a41135
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5F0DA752087929FD711CF18C941B56BBE8FB49724F10491DF895C7780E775A4448B91
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB6064 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00CB6079
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                                        • Opcode ID: c7f90035813f7f04776ca61f9e18f3d8d98bf95905070fb15a3e8fa113e553b3
                                                                                                                                                                                                        • Instruction ID: 957216ad67c101818e05f5ea2122dbb9b7551a851fe1c0ca1f5c3b104b68f23e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c7f90035813f7f04776ca61f9e18f3d8d98bf95905070fb15a3e8fa113e553b3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2AD05E32554309AEDB109F71FC08BAA3BDCA3843AAF054536F80CC6150F774C580D900
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C9112FF Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6C90BE46,00000001,?,?,?,6C90BFBF,?,?,?,6C953A30,0000000C,6C90C07A), ref: 6C911314
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                                        • Opcode ID: 021cafdaaca927f16be25fb15bde73da729b7273dbb7a68589ced5998df3fcdb
                                                                                                                                                                                                        • Instruction ID: 22b479f118ad45b6e221930dfbda83dd66f91a8aad2e93bab31e41fb135bdca3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 021cafdaaca927f16be25fb15bde73da729b7273dbb7a68589ced5998df3fcdb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2BD05E32658348AAEB00AEB25D097623BFCD385399F24843AB90DCA9C0E570C741CA44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C92FD20 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNELBASE(00000000,?,FFFFFFFF,00000000,00000003,00000080,00000000,6C927C41,?,00000000,00000000,80000000,00000001,00000000,6C927CFA,?), ref: 6C92FD3A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateFile
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 823142352-0
                                                                                                                                                                                                        • Opcode ID: e202df32f9e894732f48aa00e5f43e9904d6814bfb65479a79cf5ee0924f2a0b
                                                                                                                                                                                                        • Instruction ID: 82662dbbe7b0b75c1b080fc6a3799e958731d0be2a13a2b1cbb4cb1e0c75ca81
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e202df32f9e894732f48aa00e5f43e9904d6814bfb65479a79cf5ee0924f2a0b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4AE012B83443016FE324CB24CC85F2A73E6BFC8F10F20CA08B550962D4D670AC419611
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB3668 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __waccess_s
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4272103461-0
                                                                                                                                                                                                        • Opcode ID: 121c4f77d4c72d3789264fc0d0d617dc9724d87233f222cead199be475d85574
                                                                                                                                                                                                        • Instruction ID: 991f51a4ef218357e6011bccd3596f1c9b3f2e48f76da3e0648fb52e84b16b32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 121c4f77d4c72d3789264fc0d0d617dc9724d87233f222cead199be475d85574
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24C09B3315415D7F9F155DE5EC01C553F59D680770B105115F91C89491DD32DA555540
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB9BD7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _doexit.LIBCMT ref: 00CB9BE3
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __lock.LIBCMT ref: 00CB9AB9
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __decode_pointer.LIBCMT ref: 00CB9AF0
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __decode_pointer.LIBCMT ref: 00CB9B05
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __decode_pointer.LIBCMT ref: 00CB9B2F
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __decode_pointer.LIBCMT ref: 00CB9B45
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __decode_pointer.LIBCMT ref: 00CB9B52
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __initterm.LIBCMT ref: 00CB9B81
                                                                                                                                                                                                          • Part of subcall function 00CB9AAB: __initterm.LIBCMT ref: 00CB9B91
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1597249276-0
                                                                                                                                                                                                        • Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                                        • Instruction ID: 459e1f7ecd94e27d69909c05e14d79a6a04eb8f9f59ad838ab7788a55be08f6e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37B0923258020833EA202552AC03F867A0987C0B60F244020BA0C191E5E9A3A961A089
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C9159BE Relevance: 1.5, APIs: 1, Instructions: 6COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _doexit.LIBCMT ref: 6C9159C4
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __lock.LIBCMT ref: 6C91588A
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __decode_pointer.LIBCMT ref: 6C9158C1
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __decode_pointer.LIBCMT ref: 6C9158D6
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __decode_pointer.LIBCMT ref: 6C915900
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __decode_pointer.LIBCMT ref: 6C915916
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __decode_pointer.LIBCMT ref: 6C915923
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __initterm.LIBCMT ref: 6C915952
                                                                                                                                                                                                          • Part of subcall function 6C91587C: __initterm.LIBCMT ref: 6C915962
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1597249276-0
                                                                                                                                                                                                        • Opcode ID: 71f5aa3ab10afe7edc69d9e50ae3ebcb4a9bdbb1c92fe6d79654d1a4b596b58f
                                                                                                                                                                                                        • Instruction ID: a663266547f1313bfb08e5a021f996b5ef4cfa2848ed8a0a6fb9719151ac6f18
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 71f5aa3ab10afe7edc69d9e50ae3ebcb4a9bdbb1c92fe6d79654d1a4b596b58f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BFA00275BE870431F96091506C43F9831011775F05FD500D0BB082DAD0A5D6929C4057
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C92FDD0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(?,6C92FA42,?), ref: 6C92FDD5
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ChangeCloseFindNotification
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2591292051-0
                                                                                                                                                                                                        • Opcode ID: 2f7ea2c5a0dbcf842845bfdb267885a0eac22bb14bcbf0f844f8edada742a140
                                                                                                                                                                                                        • Instruction ID: 543aa23945d73e4e37e1c76f1b93710309f99563c8219865cb11d6f79eae3cfb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f7ea2c5a0dbcf842845bfdb267885a0eac22bb14bcbf0f844f8edada742a140
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 01A002B5B08610ABCF0CEFA5C74C81A77B9BB85B05B148848B24DC2400C738E845DB11
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA1335 Relevance: 1.3, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00CA134E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeVirtual
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1263568516-0
                                                                                                                                                                                                        • Opcode ID: 9e0d6dc2d978186011f25041a730953499f9cd91f9a24442eef223a2c8455b7c
                                                                                                                                                                                                        • Instruction ID: a2da031399242054e42b27973c697b593f0e56247ead5997400b99c6b103a558
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e0d6dc2d978186011f25041a730953499f9cd91f9a24442eef223a2c8455b7c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CE09A72B443498BDF28CFA5E892BEDB370FB49720F240129EE16272C0CB3028008A50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 6C89EF80 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 292fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C909476: __EH_prolog3_catch.LIBCMT ref: 6C913ED2
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C89EFFD
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C89F009
                                                                                                                                                                                                        • PathAddBackslashW.SHLWAPI(00000000,?,?,?,?,?,?,00000000,00000000,?,?), ref: 6C89F032
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 6C89F063
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C89F11A
                                                                                                                                                                                                        • PathAddBackslashW.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 6C89F142
                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 6C89F1F4
                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 6C89F1FF
                                                                                                                                                                                                        • FindNextFileW.KERNEL32(?,?), ref: 6C89F285
                                                                                                                                                                                                        • FindClose.KERNEL32(?), ref: 6C89F294
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Find_memset$BackslashPath$AttributesCloseDeleteFirstH_prolog3_catchNext
                                                                                                                                                                                                        • String ID: *.*$.ini$.txt
                                                                                                                                                                                                        • API String ID: 1965709584-3018804059
                                                                                                                                                                                                        • Opcode ID: f202b091791f38947b0e9f17e8bac39d77a6acbbc381d9b3b5383a308c6de35a
                                                                                                                                                                                                        • Instruction ID: 374516e9a0b64726077a495466ce07234c1338f19cd515048c3ef57ea2f56aa8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f202b091791f38947b0e9f17e8bac39d77a6acbbc381d9b3b5383a308c6de35a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BA1C3712046418FC728DF6CC945AAAB3F5BFA6328F148B1CF46687790EB31D946CB52
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAC1E0 Relevance: 9.1, APIs: 6, Instructions: 103libraryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32 ref: 00CAC22D
                                                                                                                                                                                                        • FindResourceW.KERNEL32(00000000,?,?), ref: 00CAC248
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00CAC2FF
                                                                                                                                                                                                          • Part of subcall function 00CA98B0: GetLastError.KERNEL32 ref: 00CA98B0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Library$ErrorFindFreeLastLoadResource
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3418355812-0
                                                                                                                                                                                                        • Opcode ID: 54dfd57b91a3b9163e1d38224cb778127231013bf1df8ce6315c14ad6e4c468d
                                                                                                                                                                                                        • Instruction ID: e163d6772757a0799170efa8a882dfebfb0bc333ae102dd57a910ac56e047d58
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 54dfd57b91a3b9163e1d38224cb778127231013bf1df8ce6315c14ad6e4c468d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C31CE711082039BD320DF54C881BAF7BE8EFA6358F00852DF54693252DB309948DAE2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB1970 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 00CB7058
                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CB706D
                                                                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(00CC774C), ref: 00CB7078
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(C0000409), ref: 00CB7094
                                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 00CB709B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2579439406-0
                                                                                                                                                                                                        • Opcode ID: 170875aabe69e0210f45a31d8d68b8175647efcaf78b5e82ec9e9235595ec175
                                                                                                                                                                                                        • Instruction ID: 097f8f7800a8797e298edd33914bc624a9a1ee5fbcec3b2de6b21b7cf9e5c71a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 170875aabe69e0210f45a31d8d68b8175647efcaf78b5e82ec9e9235595ec175
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8321CCB4800284EFD709DF68F888F9D3BA6FB48305F18916EE90983271E7B459839F55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAD680 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 188COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,Software\360WallPaper\LoopConfig,00CC9424,00000001,00CC61E0,0064002E,00CC61E0,?), ref: 00CAD6B5
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,Software\360WallPaper\LoopConfig,dwInterval,00000004,?,00000004), ref: 00CAD6CF
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,Software\360WallPaper\LoopConfig,emMODE,00000004,?,00000004), ref: 00CAD6E9
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI ref: 00CAD70B
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,Software\360WallPaper\LoopConfig,nIndex,00000004,?,00000004), ref: 00CAD72D
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,Software\360WallPaper\LoopConfig,size,00000004,?,00000004), ref: 00CAD747
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,00000000,CID,00000001,?,?,00000004,?,00000004), ref: 00CAD7A0
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,00000000,emType,00000004,?,00000004), ref: 00CAD7EE
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,00000000,tag,00000001,?,00000000), ref: 00CAD808
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,Software\360WallPaper\LoopConfig,ItemIndex,00000004,?,00000004), ref: 00CAD83F
                                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,Software\360WallPaper\LoopConfig,bActived,00000004,80000001,00000004), ref: 00CAD859
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                        • String ID: %s\%d$CID$ItemIndex$Software\360WallPaper\LoopConfig$bActived$dwInterval$emMODE$emType$nBagSize$nIndex$size$tag
                                                                                                                                                                                                        • API String ID: 3702945584-1569985473
                                                                                                                                                                                                        • Opcode ID: ab6ab3f7c8cc5dcdb583e2b34e1004d7f91294a15031d8ecfb3eccdee581ca66
                                                                                                                                                                                                        • Instruction ID: 4607433084b8754960acb6e84c183af3d0117fab60293afe1afe13bf85364515
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ab6ab3f7c8cc5dcdb583e2b34e1004d7f91294a15031d8ecfb3eccdee581ca66
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C151A2B0240301AFE300DB58CC46F66B7A4EFC4728F14861DF669AB1D1D7B5A905CB91
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8DC9B0 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 300windowregistrystringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000008), ref: 6C8DCA29
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,static), ref: 6C8DCA44
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 6C8DCA5A
                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 6C8DCA6F
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 6C8DCA7B
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 6C8DCABE
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 6C8DCAD5
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 6C8DCAE0
                                                                                                                                                                                                        • GetStockObject.GDI32(0000000D), ref: 6C8DCAEF
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8DCB10
                                                                                                                                                                                                        • GetObjectW.GDI32(?,0000005C,?), ref: 6C8DCB20
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 6C8DCB4B
                                                                                                                                                                                                        • CreateWindowExW.USER32(00000000,tooltips_class32,00000000,00000000,80000000,80000000,00000000,00000000,?,00000000,6C890000,00000000), ref: 6C8DCB8C
                                                                                                                                                                                                        • GetWindowTextLengthW.USER32(?), ref: 6C8DCBA2
                                                                                                                                                                                                        • GetWindowTextW.USER32(?,?,00000001), ref: 6C8DCC14
                                                                                                                                                                                                        • SendMessageW.USER32(00000006,00000401,00000001,00000000), ref: 6C8DCC81
                                                                                                                                                                                                        • SendMessageW.USER32(00000006,00000432,00000000,?), ref: 6C8DCCAE
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 6C8DCD63
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$LongMessageSend$CreateObjectText$ClassCloseCursorFontIndirectLengthLoadNameParentStock_memsetlstrcmpi
                                                                                                                                                                                                        • String ID: Anchor Color$Anchor Color Visited$static$tooltips_class32
                                                                                                                                                                                                        • API String ID: 2610959040-118425154
                                                                                                                                                                                                        • Opcode ID: e3d2f5abcf56781e8ebd5f4c7c402f9181507eb8dc1a0d647b6dfea97c1a2591
                                                                                                                                                                                                        • Instruction ID: 93d3397b55b92d2e5f761aa06178a02515dd1a4576fd871793d4bc01a9f5f713
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e3d2f5abcf56781e8ebd5f4c7c402f9181507eb8dc1a0d647b6dfea97c1a2591
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1B185B16083449FDB20EF68C988B9A77E9FF49308F214E2EF959D7681D734E8448B51
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAAEF0 Relevance: 37.2, APIs: 17, Strings: 4, Instructions: 492stringregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,Delete,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00CAAF78
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,ForceRemove,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAAF87
                                                                                                                                                                                                        • CharNextW.USER32(?,?), ref: 00CAAFD7
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?), ref: 00CAB054
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,NoRemove,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00CAB0AF
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,Val,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAB0D7
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAB541
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrcmpi$CharCloseNextlstrlen
                                                                                                                                                                                                        • String ID: Delete$ForceRemove$NoRemove$Val
                                                                                                                                                                                                        • API String ID: 1946953807-1781481701
                                                                                                                                                                                                        • Opcode ID: 9335f25b0895a6e6b182d109d387207d5f2613769b7bb56841d8ea92896ab4b5
                                                                                                                                                                                                        • Instruction ID: 728876078fe4f08c684f8ef0229792fb6147f8dc0b0757d14b128faf09a836c7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9335f25b0895a6e6b182d109d387207d5f2613769b7bb56841d8ea92896ab4b5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 26F1D1B19083139FC724EFA5C895A2FB7E8AF96708F00492EF95693252DB70CD44D792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8EAC30 Relevance: 36.2, APIs: 24, Instructions: 199COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 6C8EAC53
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EAC5E
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000080,00000177,000000FF,000000FF,00000085,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EAC80
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FA), ref: 6C8EAC9A
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EAC9F
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000080,00000177,000000FF,000000FF,00000005,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EACB8
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 6C8EACD2
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EACD7
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,0000009E,00000177,000000FF,000000FF,00000005,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EACF0
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FD), ref: 6C8EAD0A
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EAD0F
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,000000BC,00000177,000000FF,000000FF,00000005,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EAD28
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 6C8EAD42
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EAD47
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000014,00000177,000000FF,000000FF,00000005,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EAD5D
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000400), ref: 6C8EAD77
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EAD7C
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000113,000000F9,000000FF,000000FF,00000085,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EAD98
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 6C8EADAF
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EADB4
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000120,000000F2,000000FF,000000FF,00000005,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EADCD
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 6C8EADE7
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 6C8EADEC
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000120,000000F2,000000FF,000000FF,00000005,?,00000000,?,?,?,6C8EBDB0), ref: 6C8EAE05
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Item
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 369458955-0
                                                                                                                                                                                                        • Opcode ID: 6bd017107a17a39d925a77959ddd8cb49e04d2b52c357c2aae1325f2d43a54ab
                                                                                                                                                                                                        • Instruction ID: 37e7eb068b2b927e50fbca235dba80304d89370edd46a4abc94a7c11648129cb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6bd017107a17a39d925a77959ddd8cb49e04d2b52c357c2aae1325f2d43a54ab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1D51F43138971677F63096398D46FAB75E89F4BF31F224B10B634FA2D0EE90D8004658
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F6E30 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 235windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,6C94B520), ref: 6C8F6E6E
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F1,?,?), ref: 6C8F6E8E
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F1,?,00000000), ref: 6C8F6EA5
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F1,?,00000000), ref: 6C8F6EBC
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6C8F6EFC
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 6C8F6F11
                                                                                                                                                                                                        • VariantInit.OLEAUT32 ref: 6C8F6F39
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000008), ref: 6C8F6F88
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 6C8F6FB5
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 6C8F6FCB
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 6C8F6FDD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$TextVariantWindow$ClearInit
                                                                                                                                                                                                        • String ID: {!@\/*}
                                                                                                                                                                                                        • API String ID: 1369726075-336962843
                                                                                                                                                                                                        • Opcode ID: 723267762b3e01ba4d36457feeff01dfadfa317339ade63636966c7ab8efd3b3
                                                                                                                                                                                                        • Instruction ID: 5cfee936341a3794d3d80bbb0a217a50f6dc86fb2018a2a2a35a5318a6f599ae
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 723267762b3e01ba4d36457feeff01dfadfa317339ade63636966c7ab8efd3b3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75915D71204702ABE720DB64CD85FA7B3F9BFC4B54F108A2CF1659B680DBB4E8458B51
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAA4A0 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 220stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00CAA4D6
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00CAA4F1
                                                                                                                                                                                                        • CharNextW.USER32(?,?,00000000), ref: 00CAA57D
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000), ref: 00CAA582
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000), ref: 00CAA587
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000), ref: 00CAA58C
                                                                                                                                                                                                        • CharNextW.USER32(40000000,?), ref: 00CAA644
                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00CAA6A1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext$lstrlen$FreeTask
                                                                                                                                                                                                        • String ID: }}$HKCR$HKCU{Software{Classes
                                                                                                                                                                                                        • API String ID: 195132745-1142484189
                                                                                                                                                                                                        • Opcode ID: ca5a73d0f1aead53663a5e7e19c9dea6f3224e5d43c0fac4efc1a9c9e8265402
                                                                                                                                                                                                        • Instruction ID: dea449b15369901f097207dee22709218da8c991ca6cccf9afa891ca9c406d1b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca5a73d0f1aead53663a5e7e19c9dea6f3224e5d43c0fac4efc1a9c9e8265402
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22719B705083429FD720DF29D895B6BB7E4AF96308F58081DF8C187281DB75CA88CBA7
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAFB40 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 170COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00CAFB52
                                                                                                                                                                                                        • GetParent.USER32 ref: 00CAFB73
                                                                                                                                                                                                        • GetWindow.USER32(?,00000004), ref: 00CAFB7C
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00CAFB8C
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00CAFBA5
                                                                                                                                                                                                        • MonitorFromWindow.USER32(?,00000002), ref: 00CAFBC0
                                                                                                                                                                                                        • GetMonitorInfoW.USER32 ref: 00CAFBE9
                                                                                                                                                                                                        • GetWindowRect.USER32(?,000000F0), ref: 00CAFC2F
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,?,000000FF,000000FF,00000015,?,?,?,000000F0), ref: 00CAFCEB
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$LongMonitorRect$FromInfoParent
                                                                                                                                                                                                        • String ID: (
                                                                                                                                                                                                        • API String ID: 1468510684-3887548279
                                                                                                                                                                                                        • Opcode ID: bd8623eda3a484d6b76d3a748b249a1984b7f045e518185aed98d1de42dba817
                                                                                                                                                                                                        • Instruction ID: 0e0d716c836c685bf6f0345282359c0d91b3e3adefd5d549b97a9d057b358e1a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd8623eda3a484d6b76d3a748b249a1984b7f045e518185aed98d1de42dba817
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA516C712083169FC314CF69D894F6EB7E9EB89758F144A2DF851D3250EB30ED068BA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA6BF0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetStockObject.GDI32(00000011), ref: 00CA6C2B
                                                                                                                                                                                                        • GetObjectW.GDI32(00000000,0000005C,?), ref: 00CA6C39
                                                                                                                                                                                                        • GetVersion.KERNEL32 ref: 00CA6C3F
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32 ref: 00CA6C84
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6C96
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6CB1
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6CBF
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6CD5
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6CE3
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6CF9
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6D07
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00CA6D30
                                                                                                                                                                                                        • CreateFontIndirectW.GDI32 ref: 00CA6D3F
                                                                                                                                                                                                          • Part of subcall function 00CA6D60: _memset.LIBCMT ref: 00CA6D86
                                                                                                                                                                                                          • Part of subcall function 00CA6D60: GetWindowsDirectoryW.KERNEL32(00000104,00000104), ref: 00CA6D98
                                                                                                                                                                                                          • Part of subcall function 00CA6D60: lstrcatW.KERNEL32(?,\Fonts\msyh.ttf), ref: 00CA6DA8
                                                                                                                                                                                                          • Part of subcall function 00CA6D60: PathFileExistsW.KERNELBASE ref: 00CA6DB2
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateFontIndirect$Object$DirectoryExistsFilePathStockVersionWindows_memsetlstrcat
                                                                                                                                                                                                        • String ID: Tahoma
                                                                                                                                                                                                        • API String ID: 1725536611-3580928618
                                                                                                                                                                                                        • Opcode ID: 9804a68775f186c1e88faa63caeea4e6751d433369e9ad0672419b13cd9ca0a4
                                                                                                                                                                                                        • Instruction ID: 63b96b4b0da3c08c4f2a17c44d9aee914c29f36e82008675bf6b2a09eba19cab
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9804a68775f186c1e88faa63caeea4e6751d433369e9ad0672419b13cd9ca0a4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B04105B15047058FC360DF29D840A5BFBF8FF98714F004E2EE5AAC2651E770A6088FA6
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E8C40 Relevance: 22.7, APIs: 15, Instructions: 193stringwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CopyRect.USER32 ref: 6C8E8C8A
                                                                                                                                                                                                          • Part of subcall function 6C8E8F20: SendMessageW.USER32(-00000010,00000149,000000FF,00000000), ref: 6C8E8F32
                                                                                                                                                                                                          • Part of subcall function 6C8E8F20: SendMessageW.USER32(-00000010,00000148,000000FF,-00000010), ref: 6C8E8F8D
                                                                                                                                                                                                          • Part of subcall function 6C8E8F20: _wcsnlen.LIBCMT ref: 6C8E8FA0
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8E8CD4
                                                                                                                                                                                                        • GetTextMetricsW.GDI32(?,?), ref: 6C8E8CE5
                                                                                                                                                                                                        • GetDialogBaseUnits.USER32 ref: 6C8E8CFE
                                                                                                                                                                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 6C8E8D13
                                                                                                                                                                                                        • GetSysColor.USER32 ref: 6C8E8D2C
                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 6C8E8D34
                                                                                                                                                                                                        • SetBkColor.GDI32(?,-00FFFFFF), ref: 6C8E8D57
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,?), ref: 6C8E8D6E
                                                                                                                                                                                                        • ExtTextOutW.GDI32(?,?,?,00000006,?,?,?,00000000), ref: 6C8E8D89
                                                                                                                                                                                                        • SetTextColor.GDI32(?,?), ref: 6C8E8D95
                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 6C8E8DA1
                                                                                                                                                                                                        • ImageList_GetIconSize.COMCTL32(?,?,?,?,?,?), ref: 6C8E8DDA
                                                                                                                                                                                                        • SetRect.USER32(?,?,?,?), ref: 6C8E8E11
                                                                                                                                                                                                        • ImageList_Draw.COMCTL32(?,?,?,?,?,00000001,?,?,?,?), ref: 6C8E8E55
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$Text$Rect$ImageList_MessageSend$BaseCopyDialogDrawIconInflateMetricsSizeUnits_memset_wcsnlenlstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1843803677-0
                                                                                                                                                                                                        • Opcode ID: e8022fdfabbe3b28f8520fcc3e8f56df6e98d60219ccb1a48c7aceb52dcd7b25
                                                                                                                                                                                                        • Instruction ID: 53d361c4d0d7c242e2d6adeaf188b3c451542e96f43dd14144f97f872806afa1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8022fdfabbe3b28f8520fcc3e8f56df6e98d60219ccb1a48c7aceb52dcd7b25
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 73714D712047019FD324DF68C884F6AB7F9FB89718F148B1DF9A687290D734A905CB61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAFF80 Relevance: 22.6, APIs: 15, Instructions: 132COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 00CAFF8C
                                                                                                                                                                                                        • CreateCompatibleDC.GDI32(00000000), ref: 00CAFF97
                                                                                                                                                                                                        • CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 00CAFFAC
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00CAFFB8
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00CAFFD1
                                                                                                                                                                                                        • GdipCreateFromHDC.GDIPLUS ref: 00CB0011
                                                                                                                                                                                                        • GdipDrawImagePointsI.GDIPLUS(?,00000000,?,00000003), ref: 00CB0035
                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EC,?), ref: 00CB0048
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 00CB007A
                                                                                                                                                                                                        • GdipReleaseDC.GDIPLUS(?,00000000,?,000000EC,?,?,00000000,?,00000003), ref: 00CB00AD
                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000110), ref: 00CB00C0
                                                                                                                                                                                                        • ReleaseDC.USER32(?,?), ref: 00CB00CA
                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00CB00D1
                                                                                                                                                                                                        • DeleteDC.GDI32(00000000), ref: 00CB00D8
                                                                                                                                                                                                        • GdipDeleteGraphics.GDIPLUS(?,?,?,?,00000110,?,00000000,?,000000EC,?,?,00000000,?,00000003), ref: 00CB00E9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Gdip$CreateDeleteRelease$ObjectWindow$CompatibleDrawFromGraphicsImageLongPointsRectSectionSelect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2565709056-0
                                                                                                                                                                                                        • Opcode ID: 4b076be836fd09ee7bbba38eda3a8a3c0b6ee7d28e862c8a0d2f388a991cef2a
                                                                                                                                                                                                        • Instruction ID: 9ca0540d12e673b4668f2c717dd3b93a986144789e9971a30e50dd358b2bfe8c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4b076be836fd09ee7bbba38eda3a8a3c0b6ee7d28e862c8a0d2f388a991cef2a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD41E7B2508341AFD314DFA9D895EABBBF8FB88344F10891DF68683251D774E944CB62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA4760 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 233filestringtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CA47B3
                                                                                                                                                                                                        • wvsprintfW.USER32(?,?,?), ref: 00CA47D0
                                                                                                                                                                                                        • GetLocalTime.KERNEL32(?), ref: 00CA47FA
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00CA481E
                                                                                                                                                                                                          • Part of subcall function 00CA5A70: _memcpy_s.LIBCMT ref: 00CA5B04
                                                                                                                                                                                                          • Part of subcall function 00CA5A70: _wcsnlen.LIBCMT ref: 00CA5AA4
                                                                                                                                                                                                        • OutputDebugStringW.KERNEL32(?,00CC941C,00000003,?,?,00CC9414,00000002,?,?), ref: 00CA48BF
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CA492B
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,?,?,00000000,?,00000000,00000000,?,?,?,?), ref: 00CA4976
                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,?,00000000,?,?,?,?), ref: 00CA498A
                                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000000,?,?,?,?), ref: 00CA499E
                                                                                                                                                                                                        • _wcsnlen.LIBCMT ref: 00CA49A9
                                                                                                                                                                                                        • WriteConsoleW.KERNEL32(?,?,?,00000000,00000000,00CC941C,00000003,?,?,00CC9414,00000002,?,?), ref: 00CA49E5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • %d-%d-%d %d:%d:%d THREADID=%d, xrefs: 00CA484D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Write_memset_wcsnlen$ByteCharConsoleCurrentDebugFileLocalMultiOutputStringThreadTimeWide_memcpy_slstrlenwvsprintf
                                                                                                                                                                                                        • String ID: %d-%d-%d %d:%d:%d THREADID=%d
                                                                                                                                                                                                        • API String ID: 1057190044-1501258612
                                                                                                                                                                                                        • Opcode ID: 5d7796f82a825dbcd990bc7d012140cdebe4bec20eb223269b518509ae4ced51
                                                                                                                                                                                                        • Instruction ID: ee253f4fbfe1b8d598e665cca5ec6d95736aa9f5c99c03aa816fd9659b54b1c5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d7796f82a825dbcd990bc7d012140cdebe4bec20eb223269b518509ae4ced51
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD91CBB1504341AFD324DF28DC81FAFB3E8EB89314F548A1EF495832A1E774A944CB62
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E0F40 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 89timewindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(?), ref: 6C8E0F5F
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 6C8E0F6B
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000111,?,?), ref: 6C8E0F7F
                                                                                                                                                                                                        • GetCapture.USER32 ref: 6C8E0F8E
                                                                                                                                                                                                        • KillTimer.USER32(?,000003E9,?,?,?,?,?,?,6C8E1301), ref: 6C8E0FA2
                                                                                                                                                                                                        • KillTimer.USER32(?,000003E8,?,?,?,6C8E1301), ref: 6C8E0FB7
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(?), ref: 6C8E0FC7
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 6C8E0FD3
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000111,?,?), ref: 6C8E0FE7
                                                                                                                                                                                                        • SystemParametersInfoW.USER32(0000000A,00000000,?,00000000), ref: 6C8E1005
                                                                                                                                                                                                        • SetTimer.USER32(?,000003E9,000000FA,00000000), ref: 6C8E1030
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Timer$CtrlKillMessageParentSend$CaptureInfoParametersSystem
                                                                                                                                                                                                        • String ID: (
                                                                                                                                                                                                        • API String ID: 918084283-3887548279
                                                                                                                                                                                                        • Opcode ID: 915846a05037569ab097d3261f95b641f58e028a80298b83f4342ce8d95db48e
                                                                                                                                                                                                        • Instruction ID: 4c76be01f3857e982e7e4ff0ee60778e06b3d45616e411ee72c78bf021b288e3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 915846a05037569ab097d3261f95b641f58e028a80298b83f4342ce8d95db48e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE218DB5304B40ABEB249B65CA4CF5677F8FB89B1AF20891DF656C75C1CA74E4008B60
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB0972 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 68memorylibraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(0000000C,00CB0A48,?,00CA6FFE), ref: 00CB0974
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,?,00CA6FFE), ref: 00CB098D
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InterlockedPushEntrySList), ref: 00CB09A7
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InterlockedPopEntrySList), ref: 00CB09B4
                                                                                                                                                                                                        • GetProcessHeap.KERNEL32(00000000,00000008,?,?,?,?,00CA6FFE), ref: 00CB09E6
                                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000000,?,?,?,?,00CA6FFE), ref: 00CB09E9
                                                                                                                                                                                                        • InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00CB09FF
                                                                                                                                                                                                        • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00CA6FFE), ref: 00CB0A0C
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,?,?,?,00CA6FFE), ref: 00CB0A0F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Heap$AddressProcProcess$AllocCompareExchangeFeatureFreeInterlockedLibraryLoadPresentProcessor
                                                                                                                                                                                                        • String ID: InterlockedPopEntrySList$InterlockedPushEntrySList$kernel32.dll
                                                                                                                                                                                                        • API String ID: 3830925854-2586642590
                                                                                                                                                                                                        • Opcode ID: 1b246aa59b6b091e12751a06a48a0b49552b2a47ed613fc46888c1088f3fc9d7
                                                                                                                                                                                                        • Instruction ID: 23bfdaa9ddc5d0d3cf03c9a4312d5fd3dcfef047473f76f63705c3e30e0381cf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b246aa59b6b091e12751a06a48a0b49552b2a47ed613fc46888c1088f3fc9d7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AB119DB2A503419FDB209FB5EC88F5E7BA8FB56781B14887DE541D3260EBB08C40CB20
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAA548 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 119stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CharNextW.USER32(?,?,00000000), ref: 00CAA57D
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000), ref: 00CAA582
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000), ref: 00CAA587
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000), ref: 00CAA58C
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?), ref: 00CAA5DA
                                                                                                                                                                                                        • CharNextW.USER32(40000000,?), ref: 00CAA644
                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00CAA6A1
                                                                                                                                                                                                        • CharNextW.USER32(?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 00CAA6C3
                                                                                                                                                                                                        • CharNextW.USER32(?,40000000,00000001,?), ref: 00CAA6E0
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000,?), ref: 00CAA705
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext$FreeTasklstrlen
                                                                                                                                                                                                        • String ID: HKCR$HKCU{Software{Classes
                                                                                                                                                                                                        • API String ID: 1034012546-2172890117
                                                                                                                                                                                                        • Opcode ID: 6426649f88c08f85fc4e65eae1143c66a403f36d7a7f0fff6421426585d0f040
                                                                                                                                                                                                        • Instruction ID: fa2179bbed785afbd7180654c01e4ba9f7979b1e950f9eb6a72f3e1c440678cf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6426649f88c08f85fc4e65eae1143c66a403f36d7a7f0fff6421426585d0f040
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5417F705043029FD724EF64C885B6BB7E8AF9A348F54081DF8D5C7241EB74DA84CB66
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB5C2E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,00CCA2E0,0000000C,00CB5D69,00000000,00000000,?,?,00CB45FD,00CB246A), ref: 00CB5C40
                                                                                                                                                                                                        • __crt_waiting_on_module_handle.LIBCMT ref: 00CB5C4B
                                                                                                                                                                                                          • Part of subcall function 00CB9937: Sleep.KERNEL32(000003E8,?,?,00CB5B91,KERNEL32.DLL,?,00CB5AA7,?,00CB2464,?), ref: 00CB9943
                                                                                                                                                                                                          • Part of subcall function 00CB9937: GetModuleHandleW.KERNEL32(?,?,?,00CB5B91,KERNEL32.DLL,?,00CB5AA7,?,00CB2464,?), ref: 00CB994C
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00CB5C74
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,DecodePointer), ref: 00CB5C84
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00CB5CA6
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(00CCD020), ref: 00CB5CB3
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00CB5CC7
                                                                                                                                                                                                        • ___addlocaleref.LIBCMT ref: 00CB5CE5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                                                        • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                                        • API String ID: 1028249917-2843748187
                                                                                                                                                                                                        • Opcode ID: 4f329d33e039452477aca215f37a2231f87f024d709e5ee61fdea0357bd6e1de
                                                                                                                                                                                                        • Instruction ID: 2d9f9f515787f3fdddf4fd12fdfe36308eb34604402a418b4f56ea4c401ff38a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f329d33e039452477aca215f37a2231f87f024d709e5ee61fdea0357bd6e1de
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E011B171948B019FDB20AF79D805B8EBBF0EF04314F104A5DE5A9932A1CB74AA41DF14
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAFE50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 89libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EC), ref: 00CAFE64
                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00CAFE7F
                                                                                                                                                                                                        • LoadLibraryW.KERNEL32(User32.DLL), ref: 00CAFE8A
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,UpdateLayeredWindow), ref: 00CAFEA1
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAFEE5
                                                                                                                                                                                                        • GetWindowLongW.USER32 ref: 00CAFF2B
                                                                                                                                                                                                        • GetWindowRect.USER32(?,000001F4), ref: 00CAFF39
                                                                                                                                                                                                        • SetWindowPos.USER32(?,000000FF,?,?,?,?,00000001), ref: 00CAFF5F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Long$AddressLibraryLoadProcRect_memset
                                                                                                                                                                                                        • String ID: UpdateLayeredWindow$User32.DLL
                                                                                                                                                                                                        • API String ID: 3381061454-3849614841
                                                                                                                                                                                                        • Opcode ID: c85722dc4e8fcbdf11b8c0d6854a0f9069b66226452fcbafe65ef6fe4e37e7d7
                                                                                                                                                                                                        • Instruction ID: 029f2a9295ba953285725e2e0f420f56fe301a2f64b1718e67d7d631b7cd6c55
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c85722dc4e8fcbdf11b8c0d6854a0f9069b66226452fcbafe65ef6fe4e37e7d7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 853106B1504B009FE324DF6ADD49B5BBBE8FF88710F008A1DF1A687AA0D7B4A404CB11
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAEBD0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 395stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAEC25
                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CAEC36
                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\360wp\User Data\), ref: 00CAEC45
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00CAEC9C
                                                                                                                                                                                                          • Part of subcall function 00CA8150: _fgetc.LIBCMT ref: 00CA8161
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AttributesFileFolderPath_fgetc_memsetlstrcat
                                                                                                                                                                                                        • String ID: BUrl$CId$PId$SUrl$\360wp\User Data\
                                                                                                                                                                                                        • API String ID: 459572739-3131350968
                                                                                                                                                                                                        • Opcode ID: ed7878e4b21aa05d8a59632e4883e9a2d058523f0d5905b1c50c4622ac1c7c6c
                                                                                                                                                                                                        • Instruction ID: 9b7d913793aaaf70c1d3beac6cbfa090feed13e4f900587262ced09fd40cbbdc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ed7878e4b21aa05d8a59632e4883e9a2d058523f0d5905b1c50c4622ac1c7c6c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A9E1C8B1A002469FDB14DF68DC85BDE77B4FF96318F148229E4169B292E730AA05CB91
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C892DA0 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 343COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?,?,00000002,ECBB529E,?,?,?,?,6C93CE66,000000FF), ref: 6C892E1F
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C892E4C
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C892E62
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$CriticalEnterSection
                                                                                                                                                                                                        • String ID: Bw$gzip$timeout$ungzip
                                                                                                                                                                                                        • API String ID: 4242299720-512928370
                                                                                                                                                                                                        • Opcode ID: 952865a69bafe31b050daae0aa49cc1648966c269a66f488c016dd34c0e57671
                                                                                                                                                                                                        • Instruction ID: ceb210fcfa7fa7cb0ecb5f857fd36aeb32f93c13b6243b8f092f3570466a9e22
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 952865a69bafe31b050daae0aa49cc1648966c269a66f488c016dd34c0e57671
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 95C1CF712057018FD324DF2DC984B6BB3E5FF89314F148A2CE55A8BAA4EB34D805CB51
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F0E50 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,00000000,?,6C8F0505,00000000,00000000,error_code,error_code,?,?,?,?,?,00000000,000000FF), ref: 6C8F0E6A
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: FindWindowExW.USER32(?,00000000,weblogin,00000000), ref: 6C8EFD7B
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: IsWindow.USER32(00000000), ref: 6C8EFD8E
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(00000000,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFD9B
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDA6
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: GetDlgItem.USER32(?,00000002), ref: 6C8EFDAE
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(00000000,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDBD
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDC7
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDD2
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: SetWindowTextW.USER32(?,?), ref: 6C8EFE00
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000005,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFE0F
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: InvalidateRect.USER32(?,00000000,00000001,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFE1C
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: InvalidateRect.USER32 ref: 6C8EFE31
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005,00000000), ref: 6C8F0E82
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6C8F0E8D
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,00000000,?,6C8F0505,00000000,00000000,error_code,error_code,?,?,?,?,?,00000000,000000FF), ref: 6C8F0EA0
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6C8F0EAB
                                                                                                                                                                                                        • ShowWindow.USER32(?,?), ref: 6C8F0ECF
                                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,weblogin,00000000), ref: 6C8F0EE0
                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 6C8F0EE7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Show$FindInvalidateRect$ItemText
                                                                                                                                                                                                        • String ID: weblogin
                                                                                                                                                                                                        • API String ID: 1484495916-858765054
                                                                                                                                                                                                        • Opcode ID: 1bcb7a8a2d589b5f6e678c91a4db0c8180d96b120d03e615ada9592a422aa1b8
                                                                                                                                                                                                        • Instruction ID: 3b3eade735d9a26068106641000c01347d1855485d6b6211f7401da9201273d0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1bcb7a8a2d589b5f6e678c91a4db0c8180d96b120d03e615ada9592a422aa1b8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 28117C723407046BE664E679CC89FA7F3E9AFD4700F168929F265972D0DAB4E8018B20
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F0D90 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 6C8F0D97
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000000,?,?,?,6C8EEC3B,?,?,?,00000000), ref: 6C8F0DA6
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,6C8EEC3B,?,?,?,00000000), ref: 6C8F0DB1
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,6C8EEC3B,?,?,?,00000000), ref: 6C8F0DBC
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,6C8EEC3B,?,?,?,00000000), ref: 6C8F0DC7
                                                                                                                                                                                                        • ShowWindow.USER32(?,?,?,?,?,6C8EEC3B,?,?,?,00000000), ref: 6C8F0DEB
                                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,weblogin,00000000), ref: 6C8F0DFC
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,?,?,6C8EEC3B,?,?,?,00000000), ref: 6C8F0E03
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Show$FindItem
                                                                                                                                                                                                        • String ID: weblogin
                                                                                                                                                                                                        • API String ID: 756159778-858765054
                                                                                                                                                                                                        • Opcode ID: e9dd60c014c7d7762063ff1f2b284e8c2d4e559206b052840f0bb94a56d4a0ca
                                                                                                                                                                                                        • Instruction ID: 035ee49cf2ff22e56e97906a6c46114780cf0850c59dfb943df323bf1a6c48c3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e9dd60c014c7d7762063ff1f2b284e8c2d4e559206b052840f0bb94a56d4a0ca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1001BBB57447046BEB24AA75CC4AF67B3E8AF94B04F258A1DF266D71D0DAB4F4008A24
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAB980 Relevance: 15.3, APIs: 10, Instructions: 293COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fgetc_longjmp
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2506125971-0
                                                                                                                                                                                                        • Opcode ID: 2d33fa419809c1329f0eac1658794827f8082131ee024c84cd384fd0c3e8df28
                                                                                                                                                                                                        • Instruction ID: 2a62eb803900e701b30e79469a12abd51e9bdf1e4d799bb168ff85ac06d8f344
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2d33fa419809c1329f0eac1658794827f8082131ee024c84cd384fd0c3e8df28
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8CB1BF719087419FC720DF28C441A6BB7F5AF85318F148A1DF89A87352EB78EE49CB52
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E4810 Relevance: 15.3, APIs: 10, Instructions: 257COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteObject$DestroyImageList_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2242027670-0
                                                                                                                                                                                                        • Opcode ID: 76ae931c264704f4f773d99535ab6179783141439fe1d8b3e37ce1184141adc1
                                                                                                                                                                                                        • Instruction ID: 52435530fcca59ae549c4cfaa83e40d457cc9310a17aabf6bbd95b04d07d23e6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 76ae931c264704f4f773d99535ab6179783141439fe1d8b3e37ce1184141adc1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EEA15E716052C99BDF31DFA4CD84BDD7798AF9A218F20482CE95CDBA40C734EA488B55
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAFD00 Relevance: 15.1, APIs: 10, Instructions: 79COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindResourceW.KERNEL32(00CA0000,?,?), ref: 00CAFD14
                                                                                                                                                                                                        • SizeofResource.KERNEL32(00CA0000,00000000), ref: 00CAFD26
                                                                                                                                                                                                        • LoadResource.KERNEL32(00CA0000,00000000), ref: 00CAFD30
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Resource$FindLoadSizeof
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 507330600-0
                                                                                                                                                                                                        • Opcode ID: d544aa3d98e438e2e7cc70a51a74fb16fcb658bd30b7321f0b07a777ea62f10d
                                                                                                                                                                                                        • Instruction ID: 9513c6c3a9c3e973bbcdda3c28bc973a312854ee53229cb420c8f3887fd31315
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d544aa3d98e438e2e7cc70a51a74fb16fcb658bd30b7321f0b07a777ea62f10d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0214DB6600211AFD2119FE5EC98F7FB7ACEF85B55F008429FA4587210D7709C459771
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8ECEB0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 6C8ECF55
                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 6C8ECF87
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6C8ECFBE
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6C8ED00D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClearFreeStringVariant
                                                                                                                                                                                                        • String ID: `5w
                                                                                                                                                                                                        • API String ID: 1438600931-4151700305
                                                                                                                                                                                                        • Opcode ID: ede846405e7ae2d4f36c82599511e6fd656045eb18b2408c93d60d79b62c6164
                                                                                                                                                                                                        • Instruction ID: fd7c87b72da8babecfb14bb81eb6289c57293cf40085efec20909b91f94ae5bd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ede846405e7ae2d4f36c82599511e6fd656045eb18b2408c93d60d79b62c6164
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E061B2756082019FD724DF28C980B86BBF8FF8A704F14896AED14DB745CB71E905CBA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAC3E0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 171stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CA7C50: InitializeCriticalSection.KERNEL32(?,1798406C), ref: 00CA7C8B
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 00CAC480
                                                                                                                                                                                                          • Part of subcall function 00CAAAA0: lstrlenW.KERNEL32 ref: 00CAAAD2
                                                                                                                                                                                                          • Part of subcall function 00CAAAA0: lstrlenW.KERNEL32(?), ref: 00CAAAFA
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00CAC496
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00CA0000,?,00000104), ref: 00CAC4DC
                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00CAC532
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 00CAC597
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSectionlstrlen$Module$EnterFileHandleInitializeLeaveName
                                                                                                                                                                                                        • String ID: Module$Module_Raw$REGISTRY
                                                                                                                                                                                                        • API String ID: 982406398-549000027
                                                                                                                                                                                                        • Opcode ID: 1ca7579948b31005f2fa58283f625fa5eb6d1ba2e9dd6019ed9d5dd245848433
                                                                                                                                                                                                        • Instruction ID: d1f034865100954021af5a8953162a65b29d8384d35ebed8404ac172a99ff3d4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ca7579948b31005f2fa58283f625fa5eb6d1ba2e9dd6019ed9d5dd245848433
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB51B2725083429FC720EF64C8D0AAFB7E4BF8A348F44492DF59993151DB319A48DB93
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAF190 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 170filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CAF0B0: GetFileAttributesW.KERNEL32(?), ref: 00CAF105
                                                                                                                                                                                                          • Part of subcall function 00CAF0B0: DeleteFileW.KERNEL32(?), ref: 00CAF11F
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CAF1DD
                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CAF1EE
                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\360wp\User Data\), ref: 00CAF1FD
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00CAF253
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00CAF28D
                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?), ref: 00CAF2A0
                                                                                                                                                                                                          • Part of subcall function 00CA8150: _fgetc.LIBCMT ref: 00CA8161
                                                                                                                                                                                                          • Part of subcall function 00CAA8E0: _fputc.LIBCMT ref: 00CAA91B
                                                                                                                                                                                                          • Part of subcall function 00CAA8E0: _fputc.LIBCMT ref: 00CAA945
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Attributes$Delete_fputc$FolderPath_fgetc_memsetlstrcat
                                                                                                                                                                                                        • String ID: 360WPFavTmp.json$\360wp\User Data\
                                                                                                                                                                                                        • API String ID: 2589319691-1240406989
                                                                                                                                                                                                        • Opcode ID: 7ce839a691c99b5e5688a6e236ed35a75ebbca256cc54007785c6216ea0766fa
                                                                                                                                                                                                        • Instruction ID: 954b3605c0113e6ba43910735d17ee75d8f430d45e91fbee30618f58c5c1fbd4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ce839a691c99b5e5688a6e236ed35a75ebbca256cc54007785c6216ea0766fa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 235184B190020AABCF14EFA4DC95FDE7778EF15318F004629F91697191EB34AA0ADB90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAC650 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 168stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CA7C50: InitializeCriticalSection.KERNEL32(?,1798406C), ref: 00CA7C8B
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 00CAC6E0
                                                                                                                                                                                                          • Part of subcall function 00CAAAA0: lstrlenW.KERNEL32 ref: 00CAAAD2
                                                                                                                                                                                                          • Part of subcall function 00CAAAA0: lstrlenW.KERNEL32(?), ref: 00CAAAFA
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00CAC6F6
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00CA0000,?,00000104), ref: 00CAC73C
                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00CAC792
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 00CAC7F7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSectionlstrlen$Module$EnterFileHandleInitializeLeaveName
                                                                                                                                                                                                        • String ID: Module$Module_Raw$REGISTRY
                                                                                                                                                                                                        • API String ID: 982406398-549000027
                                                                                                                                                                                                        • Opcode ID: 6f03bfa5a0eaf3f725dcef148429ed90aa859800239367b6e9d60d0445324e4d
                                                                                                                                                                                                        • Instruction ID: 02e06ff05432660bc9c65fc22277a35316d82c1493160cfc6d2c5940d28d809e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f03bfa5a0eaf3f725dcef148429ed90aa859800239367b6e9d60d0445324e4d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 615183725083469FC720EF64D8C5A9FB3E4BF8A308F44492DF59A93151EB359A48CB93
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F8F80 Relevance: 13.8, APIs: 9, Instructions: 330COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6C8F90C8
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005,?,00000000), ref: 6C8F90E1
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6C8F90EC
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6C8F90F7
                                                                                                                                                                                                          • Part of subcall function 6C8F7370: SetWindowTextW.USER32(?,ECBB529E), ref: 6C8F73F1
                                                                                                                                                                                                          • Part of subcall function 6C8F7370: ShowWindow.USER32(?,00000001,?,?,?,?,?,ECBB529E), ref: 6C8F73FF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Show$Text
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 42388963-0
                                                                                                                                                                                                        • Opcode ID: 2909acd3dbac79aff4a471d9b00012354fd2bb136ab861e9cca102f170ccea71
                                                                                                                                                                                                        • Instruction ID: 2dd2388e817647109fb8cf732e22006fc8f2ff16a3758e30438aef037d893abb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2909acd3dbac79aff4a471d9b00012354fd2bb136ab861e9cca102f170ccea71
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B3D19F712047419FD324DF68C880B9BB7E5BF89324F148A6CE5A99B391DB70E905CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8DAE60 Relevance: 13.6, APIs: 9, Instructions: 94windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: GetClientRect.USER32(?,?), ref: 6C8E763A
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: CreateCompatibleDC.GDI32(?), ref: 6C8E764A
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: SelectObject.GDI32(00000000,?), ref: 6C8E7663
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: SelectObject.GDI32(00000000,?), ref: 6C8E76B6
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 6C8E76DE
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: SelectObject.GDI32(00000000,?), ref: 6C8E77DB
                                                                                                                                                                                                        • ImageList_GetImageCount.COMCTL32(?), ref: 6C8DAEB2
                                                                                                                                                                                                        • ImageList_Draw.COMCTL32(?,00000000,?,?,?,00000001), ref: 6C8DAEDF
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 6C8DAEFB
                                                                                                                                                                                                        • GetStockObject.GDI32(00000011), ref: 6C8DAF07
                                                                                                                                                                                                        • SelectObject.GDI32(?,00000000), ref: 6C8DAF19
                                                                                                                                                                                                        • SetBkMode.GDI32(?,00000001), ref: 6C8DAF2A
                                                                                                                                                                                                        • DrawTextW.USER32(?,?,00000000,?,00000010), ref: 6C8DAF49
                                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 6C8DAF59
                                                                                                                                                                                                        • SelectObject.GDI32(?,00000000), ref: 6C8DAF61
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$Select$Image$DrawList_Mode$ClientCompatibleCountCreateMessageRectSendStockText
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2708649652-0
                                                                                                                                                                                                        • Opcode ID: 8a78a10c1e0ebe02a23c95ce900b08a368c6a0ed16d3db7fd03df0349055de93
                                                                                                                                                                                                        • Instruction ID: b9aa41bdba8d22c27c1df5c5564280f22bef7dfb073bd917939be681bc540dcc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8a78a10c1e0ebe02a23c95ce900b08a368c6a0ed16d3db7fd03df0349055de93
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 143129B1608700AFD724DB68C989F97B3F8FB89718F20891DF65AD3680D674E840CB61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA7D80 Relevance: 13.6, APIs: 9, Instructions: 84COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fputc$__fileno__flsbuf__lock_file
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3363400969-0
                                                                                                                                                                                                        • Opcode ID: 61262e86fc43792fcd9eeb9da327fc6b1aec16ac218c7288af51f8c71fa67894
                                                                                                                                                                                                        • Instruction ID: 27480db160c215cbf176db53d38e5745fe029ec3e52049418610b96b76dbb78b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 61262e86fc43792fcd9eeb9da327fc6b1aec16ac218c7288af51f8c71fa67894
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E21CCB0214441AFD310DF68CC91D76B7A9AF9A345F28458DE6E04F362C632A952DFA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAAF59 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112stringregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,Delete,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00CAAF78
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,ForceRemove,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAAF87
                                                                                                                                                                                                        • CharNextW.USER32(?,?), ref: 00CAAFD7
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?), ref: 00CAB054
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,NoRemove,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00CAB0AF
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,Val,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAB0D7
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAB541
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrcmpi$CharCloseNextlstrlen
                                                                                                                                                                                                        • String ID: Delete$ForceRemove
                                                                                                                                                                                                        • API String ID: 1946953807-3704084903
                                                                                                                                                                                                        • Opcode ID: 27ae48281f72838977409891665fc0417c97e63af010e8c7cac036211507f95d
                                                                                                                                                                                                        • Instruction ID: 10d837afcd6bd128d57d64ab2f2ea7765efd50c04a2136b95b329923abb260f5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27ae48281f72838977409891665fc0417c97e63af010e8c7cac036211507f95d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7131C171A053279FC7299BA5D851B3FF3E8AF86B08F04492EF85693242DB708D00D792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAAF57 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112stringregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,Delete,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00CAAF78
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,ForceRemove,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAAF87
                                                                                                                                                                                                        • CharNextW.USER32(?,?), ref: 00CAAFD7
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?), ref: 00CAB054
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,NoRemove,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00CAB0AF
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,Val,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAB0D7
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,00CABE18,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00CAB541
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrcmpi$CharCloseNextlstrlen
                                                                                                                                                                                                        • String ID: Delete$ForceRemove
                                                                                                                                                                                                        • API String ID: 1946953807-3704084903
                                                                                                                                                                                                        • Opcode ID: ddc8bd97b720db42fb0cbe55ead08ec4d37f9580d837a2139cf800b5ee6fc816
                                                                                                                                                                                                        • Instruction ID: 0e55b67d056edcd4b75590d5f3a7e1eef797f37d9beba41479ad44436a024bff
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ddc8bd97b720db42fb0cbe55ead08ec4d37f9580d837a2139cf800b5ee6fc816
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE31D271A053279F87295BA5D851B3FF3E8AF86B08F04492EF85693252DB708D00D392
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAA090 Relevance: 12.1, APIs: 8, Instructions: 129registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00CAA0D7
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 00CAA0EE
                                                                                                                                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 00CAA136
                                                                                                                                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00CAA176
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00CAA185
                                                                                                                                                                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00CAA19B
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 00CAA1AC
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00CAA1D4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$Enum$DeleteOpen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3743465055-0
                                                                                                                                                                                                        • Opcode ID: b13965a75ba4c8e4b2564b14ef788375fe1eac34854e588af742f90bac89616d
                                                                                                                                                                                                        • Instruction ID: 3905596dd6909842e2f36a0b2222691443293bc4db2ec5709f52bba1d693536e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b13965a75ba4c8e4b2564b14ef788375fe1eac34854e588af742f90bac89616d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B412AB1608241AF8324DF59D894D6FF7E9EBC9754F148A1EFA9AD3210D730D904CBA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E0DA0 Relevance: 12.1, APIs: 8, Instructions: 81COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCapture.USER32 ref: 6C8E0DAA
                                                                                                                                                                                                        • ClientToScreen.USER32(?,?), ref: 6C8E0DCF
                                                                                                                                                                                                        • GetWindowRect.USER32 ref: 6C8E0DF4
                                                                                                                                                                                                        • PtInRect.USER32(00000000,?,?), ref: 6C8E0E09
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 6C8E0E3A
                                                                                                                                                                                                        • UpdateWindow.USER32(?), ref: 6C8E0E44
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 6C8E0E64
                                                                                                                                                                                                        • UpdateWindow.USER32(?), ref: 6C8E0E6E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Rect$Window$InvalidateUpdate$CaptureClientScreen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3949773918-0
                                                                                                                                                                                                        • Opcode ID: a5c3909ece1090da63e58821abdb93b5970ea765aa5b1a51002d311fcf1206a6
                                                                                                                                                                                                        • Instruction ID: 19a3da13c33e7af861d7df37a0e676e91f2041e8eab4629de715fb8393a3789a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a5c3909ece1090da63e58821abdb93b5970ea765aa5b1a51002d311fcf1206a6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71216BB16187019BD724EF24CA88B5BBBF9FB89B08F148D2DF54AC3640DB75E4448B61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C928C50 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 330COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C928C6E
                                                                                                                                                                                                        • GetFileSizeEx.KERNEL32(?,?,00000000,00000CB4,00000000), ref: 6C928C80
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileSize_memset
                                                                                                                                                                                                        • String ID: N/f$.\QHImageHlp.c$GetFileSizeEx()$PE
                                                                                                                                                                                                        • API String ID: 3908401472-130437645
                                                                                                                                                                                                        • Opcode ID: b0c670557a833d5309ebcbd93594c10747e8e1b1b71adc03b9b2d8a5da06e799
                                                                                                                                                                                                        • Instruction ID: 34082c8868ad767393722e8166607566bbe6d7a02f0ba42e2d1e48316b7c747c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b0c670557a833d5309ebcbd93594c10747e8e1b1b71adc03b9b2d8a5da06e799
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60C195B1654305EBE704DF15CC40BABB3E8BF94748F408929F99497B84E779E908CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C8C50 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 233stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000004,errmsg,00000000,errno,?,?,?,?,?,?,00000000,000000FF,?,?,?,ECBB529E), ref: 6C8C8E12
                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000004,username), ref: 6C8C8EE7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrlen
                                                                                                                                                                                                        • String ID: errmsg$errno$qid$user$username
                                                                                                                                                                                                        • API String ID: 1659193697-2795313531
                                                                                                                                                                                                        • Opcode ID: 46c977462f66a2d22762719617722731cf570248027364598ff73629229217a1
                                                                                                                                                                                                        • Instruction ID: 66fe7ce224eedd211eea0303a72697c0a0c08a1d31f973f176eb9aab5ca6d2b5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46c977462f66a2d22762719617722731cf570248027364598ff73629229217a1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5E91A271A44258DFDB20CB68C944BDEB7B5AF65308F1049EAD449A7A40DB30DE48CBA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAAC00 Relevance: 10.7, APIs: 7, Instructions: 229stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CA9BD0: lstrcmpiW.KERNEL32(?,?,?,00000000,?,00CAAC72,?,?,?,?,00000000,?,00000000,00CAB146,?,?), ref: 00CA9C4E
                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,?), ref: 00CAACCF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: lstrcmpilstrlen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3649823140-0
                                                                                                                                                                                                        • Opcode ID: 2ccbf271ab4e76047dfc4c421c38d9ae8d3425b423af9e93c54d08a62363dcfd
                                                                                                                                                                                                        • Instruction ID: fd06da6ae5d97e17e328a2d1d096d4551812f0eb423fd77918ee3504afadbe99
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ccbf271ab4e76047dfc4c421c38d9ae8d3425b423af9e93c54d08a62363dcfd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C971C272A043028BC324DF55C891AAFB3E9EFDA718F44491DF58A93241EB349E54D7A3
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB30D7 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3886058894-0
                                                                                                                                                                                                        • Opcode ID: 8e8b7ced85f418c975c624e84955b8cb391f7acb6fbc817dca29cab7efa6ee10
                                                                                                                                                                                                        • Instruction ID: dc3e5b5e06a1dfccf00080bfddf7482b7783ac8c0872afb8813b9c10f2c60d82
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e8b7ced85f418c975c624e84955b8cb391f7acb6fbc817dca29cab7efa6ee10
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D151F431A00684EBCF249FAE8C455DEBBB9EF81320F248629F83596192D7309F55DB61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F48B0 Relevance: 10.7, APIs: 7, Instructions: 189windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C899920: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,00000000), ref: 6C899956
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 6C8F49EB
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 6C8F4A07
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000144,00000000,00000000), ref: 6C8F4A1C
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 6C8F4A2E
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6C8F4A40
                                                                                                                                                                                                          • Part of subcall function 6C899170: FindResourceW.KERNEL32(00000000,00000000,00000006,?,mid=,00000000,?,6C89759B,?), ref: 6C899187
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 6C8F4A54
                                                                                                                                                                                                          • Part of subcall function 6C8F3E00: SetWindowTextW.USER32(?,6C94B520), ref: 6C8F3E3E
                                                                                                                                                                                                          • Part of subcall function 6C8F3E00: SendMessageW.USER32(?,000000F1,?,76C223D0), ref: 6C8F3E5E
                                                                                                                                                                                                          • Part of subcall function 6C8F3E00: SendMessageW.USER32(?,000000F1,?,00000000), ref: 6C8F3E75
                                                                                                                                                                                                          • Part of subcall function 6C8F3E00: SendMessageW.USER32(?,000000F1,?,00000000), ref: 6C8F3E8C
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,?), ref: 6C8F4ACE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$FindResourceWindow$ShowText
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1815239913-0
                                                                                                                                                                                                        • Opcode ID: 91f182dc887bcf08f2b78a17dca6625035ee88d57e10efee2ea6a48c336bee3a
                                                                                                                                                                                                        • Instruction ID: e064d48fd56ade512ea687b091ece6978bc6200434b9dfe908bd53af261278ff
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 91f182dc887bcf08f2b78a17dca6625035ee88d57e10efee2ea6a48c336bee3a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2361BC70704701AFE314DB68CD84F56B7A8BBC8768F108A69E6689B3D0D774E8058BA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8D4E00 Relevance: 10.7, APIs: 7, Instructions: 185COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memmove_s$_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2102975174-0
                                                                                                                                                                                                        • Opcode ID: 24134329524ad8adc4fc38b23ec1dd2a041a782ef27a81ed376dbb891d4a928c
                                                                                                                                                                                                        • Instruction ID: 53bfe506adeb702355ab6058175551a428a15748f60061123275cf3965b6eb9a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24134329524ad8adc4fc38b23ec1dd2a041a782ef27a81ed376dbb891d4a928c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC51C172B042015FC718DF38D98486B77E9EBC4318F058E6DEC559B749EB30E9098BA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CABF70 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _fgetc.LIBCMT ref: 00CABF7D
                                                                                                                                                                                                        • _fgetc.LIBCMT ref: 00CABFCE
                                                                                                                                                                                                        • _fgetc.LIBCMT ref: 00CAC027
                                                                                                                                                                                                          • Part of subcall function 00CB2581: __lock_file.LIBCMT ref: 00CB25C1
                                                                                                                                                                                                          • Part of subcall function 00CB2581: __fileno.LIBCMT ref: 00CB25D1
                                                                                                                                                                                                        • _fgetc.LIBCMT ref: 00CAC067
                                                                                                                                                                                                        • _longjmp.LIBCMT ref: 00CAC0AB
                                                                                                                                                                                                        • _longjmp.LIBCMT ref: 00CAC0C3
                                                                                                                                                                                                        • _longjmp.LIBCMT ref: 00CAC0E0
                                                                                                                                                                                                          • Part of subcall function 00CAB980: _fgetc.LIBCMT ref: 00CAB9A3
                                                                                                                                                                                                          • Part of subcall function 00CAB980: _fgetc.LIBCMT ref: 00CAB9D0
                                                                                                                                                                                                          • Part of subcall function 00CAB980: _fgetc.LIBCMT ref: 00CAB9FA
                                                                                                                                                                                                          • Part of subcall function 00CAB980: _fgetc.LIBCMT ref: 00CABAB0
                                                                                                                                                                                                          • Part of subcall function 00CA85A0: _fgetc.LIBCMT ref: 00CA85C7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fgetc$_longjmp$__fileno__lock_file
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3435852610-0
                                                                                                                                                                                                        • Opcode ID: 95d4a8a79c80cde20f25cc34e7568610dc842ff1562b538527b91b8a17f28e78
                                                                                                                                                                                                        • Instruction ID: aa0b70288c9b9ce7de1ee52951a343402a73cd1b7a18f78039e600aa3ac60010
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 95d4a8a79c80cde20f25cc34e7568610dc842ff1562b538527b91b8a17f28e78
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AE4114709017429FD3209B28CC85B7BBBA4AF57318F18891DF8A647383D735E80997A2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C9009D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 107COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C900A4F
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C900AF2
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C900B49
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • Real out of unsigned integer range, xrefs: 6C900ABA
                                                                                                                                                                                                        • Type is not convertible to uint, xrefs: 6C900B11
                                                                                                                                                                                                        • Negative integer can not be converted to unsigned integer, xrefs: 6C900A1D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throw
                                                                                                                                                                                                        • String ID: Negative integer can not be converted to unsigned integer$Real out of unsigned integer range$Type is not convertible to uint
                                                                                                                                                                                                        • API String ID: 2005118841-1738163505
                                                                                                                                                                                                        • Opcode ID: f2d9c90845868e6d988f1bc2680c2d6e319537b28c8d6636a79e26dec6e198b1
                                                                                                                                                                                                        • Instruction ID: 0a047eb99e7b7ee40e1d88f11aad8cdd3ed2a8512e888e2aeb64fee7a58e0528
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2d9c90845868e6d988f1bc2680c2d6e319537b28c8d6636a79e26dec6e198b1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70418E7110C7809BD324DF54D944BEAB3E8FB85714F108E6EF59D82A80EB35E448CB56
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C900830 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 100COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C9008C7
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C90093C
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C900993
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • Real out of signed integer range, xrefs: 6C900904
                                                                                                                                                                                                        • integer out of signed integer range, xrefs: 6C900895
                                                                                                                                                                                                        • Type is not convertible to int, xrefs: 6C90095B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throw
                                                                                                                                                                                                        • String ID: Real out of signed integer range$Type is not convertible to int$integer out of signed integer range
                                                                                                                                                                                                        • API String ID: 2005118841-3748601619
                                                                                                                                                                                                        • Opcode ID: 064d4903f3b2385205db876b1e2545f4fb60998911eed79b57163374363b9c59
                                                                                                                                                                                                        • Instruction ID: cd41b992c60095daffb64a390043341d3ce40586c573b26125356df2a00ca2da
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 064d4903f3b2385205db876b1e2545f4fb60998911eed79b57163374363b9c59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A31A37210C7849BD324DF58D944BEAB7F8FB89318F108E9DE59D82A90DF35A448CB52
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB0390 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00CB03B6
                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CB03CB
                                                                                                                                                                                                        • PtInRect.USER32(?), ref: 00CB043A
                                                                                                                                                                                                        • PtInRect.USER32 ref: 00CB0446
                                                                                                                                                                                                        • PostQuitMessage.USER32(00000000), ref: 00CB044E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • \360bizhi\update\stat.dat, xrefs: 00CB0410
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Rect$FolderMessagePathPostQuit_memset
                                                                                                                                                                                                        • String ID: \360bizhi\update\stat.dat
                                                                                                                                                                                                        • API String ID: 1059627460-2366420136
                                                                                                                                                                                                        • Opcode ID: d052e7abb00fba1ea1c29d253cc01bf6d8c1ec20ddaf2b749a8a0808a2dfd31a
                                                                                                                                                                                                        • Instruction ID: 3efbd042cb940c1136a0c495001a2feac11cf5733e41e36bdf21fc6ea92b8001
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d052e7abb00fba1ea1c29d253cc01bf6d8c1ec20ddaf2b749a8a0808a2dfd31a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D821C571204301ABD324EB64EC96FAF77E8EFD9744F44492DF54596181EB70E608CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA7DA9 Relevance: 10.6, APIs: 7, Instructions: 62COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fputc$__fileno__flsbuf__lock_file
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3363400969-0
                                                                                                                                                                                                        • Opcode ID: f6757a401782d3bf3d44fed3c868fe545e2a0205f67ab50a2283da8a6ae96d3e
                                                                                                                                                                                                        • Instruction ID: d500dc735d5f4cc7d6fa8125e6f43537fa9e0cedcc27a8b88914150450221daa
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f6757a401782d3bf3d44fed3c868fe545e2a0205f67ab50a2283da8a6ae96d3e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1D11EEB0214480AFD310DF64C891E76B7A8BF9E340F2805CDE6F04F262C6326952DFA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E0C20 Relevance: 10.6, APIs: 7, Instructions: 58timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetCapture.USER32(?,?,?,6C8E118F,?,?,?), ref: 6C8E0C2E
                                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?,?), ref: 6C8E0C4D
                                                                                                                                                                                                        • GetCapture.USER32 ref: 6C8E0C58
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001,?,?,6C8E118F,?,?,?), ref: 6C8E0C6B
                                                                                                                                                                                                        • UpdateWindow.USER32(?), ref: 6C8E0C75
                                                                                                                                                                                                        • SystemParametersInfoW.USER32(00000016,00000000,?,00000000), ref: 6C8E0C99
                                                                                                                                                                                                        • SetTimer.USER32(?,000003E8,000000FA,00000000), ref: 6C8E0CBA
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CaptureWindow$CallInfoInvalidateParametersProcRectSystemTimerUpdate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3123952011-0
                                                                                                                                                                                                        • Opcode ID: dfa2b61c1df1db9a17260693e40549ded2d857d443abcf2d16214220f04af9bc
                                                                                                                                                                                                        • Instruction ID: ba154ed18c120b6fd6fa58af2b39f3df428fff29bd96d8837f1c718c6ac791fb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dfa2b61c1df1db9a17260693e40549ded2d857d443abcf2d16214220f04af9bc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE114FB53087409BD324DB54CA88F17B7F9FB89B08F21891CF19A97580C770E8059721
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAFAB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,flashapp_2011_10_27_tangshan), ref: 00CAFABC
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?), ref: 00CAFAFB
                                                                                                                                                                                                        • SetEvent.KERNEL32(00000000), ref: 00CAFB09
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00CAFB10
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: _memset.LIBCMT ref: 00CAF3FD
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: StrStrIW.KERNELBASE(?,/s StartFrom=360wpsrv), ref: 00CAF417
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: SHGetValueW.SHLWAPI(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe,00000000,?,?,?), ref: 00CAF48B
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: PathFileExistsW.KERNELBASE(?), ref: 00CAF499
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: StrStrIW.SHLWAPI(?,onlyimport), ref: 00CAF4CF
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: MessageBoxW.USER32(00000000,00CC6674,00CC6698,00000014), ref: 00CAF4E8
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: ShellExecuteW.SHELL32(00000000,open,http://bizhi.360.cn/,00000000,00000000,00000005), ref: 00CAF506
                                                                                                                                                                                                          • Part of subcall function 00CAF3B0: SHSetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,recordloopinfo,?,?,?), ref: 00CAF53B
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00CAFB2C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • flashapp_2011_10_27_tangshan, xrefs: 00CAFAB1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseEventHandleValue$CreateErrorExecuteExistsFileLastMessagePathShell_memset
                                                                                                                                                                                                        • String ID: flashapp_2011_10_27_tangshan
                                                                                                                                                                                                        • API String ID: 3566164963-2177179615
                                                                                                                                                                                                        • Opcode ID: 6fa0d79a87c7fd810e8ef632dbacfdd3db70c6e9020e3281cea59c6d468e4e18
                                                                                                                                                                                                        • Instruction ID: d9c72461dc72c3fbb786c3ff9cba6b1ff032128fa2bf2c839c3ab64128eb44d6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6fa0d79a87c7fd810e8ef632dbacfdd3db70c6e9020e3281cea59c6d468e4e18
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6E01F232244112ABC3105BA8FC65FEF3278DBD6715F048828F806D6141E7709902A771
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F08D0 Relevance: 9.3, APIs: 6, Instructions: 260COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6C8F0A1A
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005,00000000), ref: 6C8F0A32
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6C8F0A3D
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: FindWindowExW.USER32(?,00000000,weblogin,00000000), ref: 6C8EFD7B
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: IsWindow.USER32(00000000), ref: 6C8EFD8E
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(00000000,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFD9B
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDA6
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: GetDlgItem.USER32(?,00000002), ref: 6C8EFDAE
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(00000000,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDBD
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDC7
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000000,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFDD2
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: SetWindowTextW.USER32(?,?), ref: 6C8EFE00
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: ShowWindow.USER32(?,00000005,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFE0F
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: InvalidateRect.USER32(?,00000000,00000001,?,00000010,00000010,00000000,6C939518,000000FF,6C8EF8C2,00000000), ref: 6C8EFE1C
                                                                                                                                                                                                          • Part of subcall function 6C8EFD20: InvalidateRect.USER32 ref: 6C8EFE31
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Show$InvalidateRect$FindItemText
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1323298968-0
                                                                                                                                                                                                        • Opcode ID: ae52a2e6a0f9131d44da2db358f63eb69807da3533df6e333a3d11eeac69e811
                                                                                                                                                                                                        • Instruction ID: e572f46b54b42046f214f4ca5ac6b46a5a1fd6543a9590e4a7ba8439d9557356
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae52a2e6a0f9131d44da2db358f63eb69807da3533df6e333a3d11eeac69e811
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C8B17E712047818FD724CF68C884B9BB7E5BF89324F144A6CE5A98B7D1CB71E905CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA9D90 Relevance: 9.1, APIs: 6, Instructions: 126COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CharNextW.USER32(?,?,00000000,?,00000000,00CABD51,?,?,00000000,?,?,?,?,?,00000001,?), ref: 00CA9DCD
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000,?,00000000,00CABD51,?,?,00000000,?,?,?,?,?,00000001), ref: 00CA9DED
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000,?,00000000,00CABD51,?,?,00000000,?,?,?,?,?,00000001), ref: 00CA9E06
                                                                                                                                                                                                        • CharNextW.USER32(?,?,?,00000000,?,00000000,00CABD51,?,?,00000000,?,?,?,?,?,00000001), ref: 00CA9E0D
                                                                                                                                                                                                        • CharNextW.USER32(00000000,?,?,00000000,?,00000000,00CABD51,?,?,00000000,?,?,?,?,?,00000001), ref: 00CA9E5B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3213498283-0
                                                                                                                                                                                                        • Opcode ID: 329b4896438e61abf97330b15fb18c784b8c397b8193b2f5c845e3657ae6a881
                                                                                                                                                                                                        • Instruction ID: 25dd7f5449a58fe82fa8e19c6391ed3421106e458506ff5a538cd90b576e059e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 329b4896438e61abf97330b15fb18c784b8c397b8193b2f5c845e3657ae6a881
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE410731604223CBCB24DF38C882637B3E6EFA7715B548465E141CB359EB31D992C395
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAA430 Relevance: 9.1, APIs: 6, Instructions: 88COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000010,?,?,00CAA696,?,?,?,?,?,?,?,00000000), ref: 00CAA438
                                                                                                                                                                                                          • Part of subcall function 00CAA010: lstrcmpiW.KERNEL32(?,?,00000010,-00000004,00000000,76C0A7D0,00CAA44D,?,?,00CAA696,?), ref: 00CAA030
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000010,?,?,00CAA696,?,?,?,?,?,?,?,00000000), ref: 00CAA455
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000010,?,?,00CAA696,?,?,?,?,?,?,?,00000000), ref: 00CAA472
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSection$Leave$Enterlstrcmpi
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 431788158-0
                                                                                                                                                                                                        • Opcode ID: a77011de2e4a9c03c50cba8b4b8125359ef6b61c2902940cd1053eb8867101d6
                                                                                                                                                                                                        • Instruction ID: ec50a26f2a844faa1ed0939d2fc0f505c7ce5cb68aa55c948fcafb327c5642e5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a77011de2e4a9c03c50cba8b4b8125359ef6b61c2902940cd1053eb8867101d6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CF21C3326046119BD3209B69DC44FAFB3E8FF99728F01452EF65AD3260C7709D05CBA6
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB4FC3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CreateFrameInfo.LIBCMT ref: 00CB4FEB
                                                                                                                                                                                                          • Part of subcall function 00CB186B: __getptd.LIBCMT ref: 00CB1879
                                                                                                                                                                                                          • Part of subcall function 00CB186B: __getptd.LIBCMT ref: 00CB1887
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB4FF5
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __getptd_noexit.LIBCMT ref: 00CB5D91
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __amsg_exit.LIBCMT ref: 00CB5D9E
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB5003
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB5011
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB501C
                                                                                                                                                                                                        • _CallCatchBlock2.LIBCMT ref: 00CB5042
                                                                                                                                                                                                          • Part of subcall function 00CB1910: __CallSettingFrame@12.LIBCMT ref: 00CB195C
                                                                                                                                                                                                          • Part of subcall function 00CB50E9: __getptd.LIBCMT ref: 00CB50F8
                                                                                                                                                                                                          • Part of subcall function 00CB50E9: __getptd.LIBCMT ref: 00CB5106
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1602911419-0
                                                                                                                                                                                                        • Opcode ID: 559fad235355ce155d8437e883c5ada3b5e610892d43ee799469bfe945b0b5c1
                                                                                                                                                                                                        • Instruction ID: 17fb158951fe91bde2ee0bdc9c0d1fa31fb2ccd8d416d69521101f72a784f43f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 559fad235355ce155d8437e883c5ada3b5e610892d43ee799469bfe945b0b5c1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4211D4B1D00209DFDB00EFA4D94ABEDBBB0FF08315F148569F814A7252DB399A15AF90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C90EED4 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CreateFrameInfo.LIBCMT ref: 6C90EEFC
                                                                                                                                                                                                          • Part of subcall function 6C90C838: __getptd.LIBCMT ref: 6C90C846
                                                                                                                                                                                                          • Part of subcall function 6C90C838: __getptd.LIBCMT ref: 6C90C854
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90EF06
                                                                                                                                                                                                          • Part of subcall function 6C910060: __getptd_noexit.LIBCMT ref: 6C910063
                                                                                                                                                                                                          • Part of subcall function 6C910060: __amsg_exit.LIBCMT ref: 6C910070
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90EF14
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90EF22
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90EF2D
                                                                                                                                                                                                        • _CallCatchBlock2.LIBCMT ref: 6C90EF53
                                                                                                                                                                                                          • Part of subcall function 6C90C8DD: __CallSettingFrame@12.LIBCMT ref: 6C90C929
                                                                                                                                                                                                          • Part of subcall function 6C90EFFA: __getptd.LIBCMT ref: 6C90F009
                                                                                                                                                                                                          • Part of subcall function 6C90EFFA: __getptd.LIBCMT ref: 6C90F017
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1602911419-0
                                                                                                                                                                                                        • Opcode ID: 647ddfb19409566eda0789c3ebc67c249f41857033ce4b72498ee5b2f7f060f6
                                                                                                                                                                                                        • Instruction ID: d56727432a63708743edd865aa2e92ea2fe8e300e708f71120b42873a1217afb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 647ddfb19409566eda0789c3ebc67c249f41857033ce4b72498ee5b2f7f060f6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45113771D40249DFDB00DFA4C445BEE7BB1FF24314F1080AAE854A7B50DB398A289FA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E8EA0 Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 6C8E8EBD
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 6C8E8EC6
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8E8EDF
                                                                                                                                                                                                        • GetTextMetricsW.GDI32(00000000,?), ref: 6C8E8EED
                                                                                                                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 6C8E8EFC
                                                                                                                                                                                                        • GetSystemMetrics.USER32(0000000F), ref: 6C8E8F0A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Metrics$ItemReleaseSystemText_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2343589144-0
                                                                                                                                                                                                        • Opcode ID: 6ecbbf3cfe5b5bb7cbdc2f5ae35be52c3ca46988d2f1d9cb15032835cd0e36cb
                                                                                                                                                                                                        • Instruction ID: 4840c2f77d28e7d3c86cd043e6b0a77e8039894c048702af1ad4f946774433ea
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ecbbf3cfe5b5bb7cbdc2f5ae35be52c3ca46988d2f1d9cb15032835cd0e36cb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF018475608201AFCB14EF5CD948BAB7BF8FF8A715F10845AF908CA140E770C605CBA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAFDD0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCursorPos.USER32(?), ref: 00CAFDDC
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00CAFDEB
                                                                                                                                                                                                        • PtInRect.USER32(?,?,?), ref: 00CAFE05
                                                                                                                                                                                                        • PtInRect.USER32(?,?,?), ref: 00CAFE19
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00CAFE2D
                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 00CAFE34
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Cursor$Rect$ClientLoadScreen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2376885720-0
                                                                                                                                                                                                        • Opcode ID: 9d8d6a00713757eff5968261c31e4da263f77e71c735eee0f4a6cee8aedc1b35
                                                                                                                                                                                                        • Instruction ID: c2e4fe1979cfaa474757032397c2333b1af332fc12944bda45348a2f1d5d62a6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d8d6a00713757eff5968261c31e4da263f77e71c735eee0f4a6cee8aedc1b35
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6018176108302BFD714EB64EC55EAB77A8EBC8755F008A1DF94A82251E774E805CB61
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E0D30 Relevance: 9.0, APIs: 6, Instructions: 43windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,00000202,?,?), ref: 6C8E0D48
                                                                                                                                                                                                        • GetCapture.USER32 ref: 6C8E0D53
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(?), ref: 6C8E0D68
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 6C8E0D74
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000111,?,?), ref: 6C8E0D88
                                                                                                                                                                                                        • ReleaseCapture.USER32 ref: 6C8E0D8E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Capture$CallCtrlMessageParentProcReleaseSendWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1376841137-0
                                                                                                                                                                                                        • Opcode ID: 3fdcf0092c0c4f7192cbda25ba8f744eaa597a1298dbc576ce3c70b790378ed3
                                                                                                                                                                                                        • Instruction ID: 2b3b298b6fb042c833406f142e3452ed0148b0315a4cd8876cfbe888d8ec1e3c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3fdcf0092c0c4f7192cbda25ba8f744eaa597a1298dbc576ce3c70b790378ed3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 73F062B53056445BD7209765CE48A27B7FDFB8E71AB148A18FA9AC3541CB31E8409B20
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8EAFB0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6C8EAFDA
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,6C94B520), ref: 6C8EAFF0
                                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6C8EB007
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,6C94B520), ref: 6C8EB01D
                                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6C8EB034
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,6C94B520), ref: 6C8EB04A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Text
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 848690642-0
                                                                                                                                                                                                        • Opcode ID: 1471de6ceaa5b068e7b7c7920c675b74b503ca1560a0e9a992841901aefd2d52
                                                                                                                                                                                                        • Instruction ID: b74086ac8ff8fc57196573323fd4a52306a5f34ef07e6a4f1ceafa78abf04a94
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1471de6ceaa5b068e7b7c7920c675b74b503ca1560a0e9a992841901aefd2d52
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8001E171606B079BDB349B70CA5CBBB77B4EB4A715F104D2CA17AC2840EA35F140DB18
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C92AD90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 249COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C92ADFB
                                                                                                                                                                                                        • _wcschr.LIBCMT ref: 6C92AE77
                                                                                                                                                                                                          • Part of subcall function 6C921B50: __CxxThrowException@8.LIBCMT ref: 6C921B80
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Exception@8Throw_memset_wcschr
                                                                                                                                                                                                        • String ID: .\QHRCFromFile.cpp
                                                                                                                                                                                                        • API String ID: 1826305549-129007012
                                                                                                                                                                                                        • Opcode ID: ceb373c7fab6c580e2cfc10a504f64afef0caa0eccbd7a765661bab122ad68f8
                                                                                                                                                                                                        • Instruction ID: 49c93bd4bf3eb7d3edecab749268b2c6b6b72916510389eb3eea791996b3ab59
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ceb373c7fab6c580e2cfc10a504f64afef0caa0eccbd7a765661bab122ad68f8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E181E2B2E1420AABCB10DF94DC41EEFB3B8EF58714F144119E955A7B44EB38D9158BE0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CACB70 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 236COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CA8DC0: _fputc.LIBCMT ref: 00CA8DFB
                                                                                                                                                                                                          • Part of subcall function 00CA8DC0: _fputc.LIBCMT ref: 00CA8E25
                                                                                                                                                                                                          • Part of subcall function 00CA8540: _fputc.LIBCMT ref: 00CA8577
                                                                                                                                                                                                          • Part of subcall function 00CAC980: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000008,00000000,00000000,00000000,00000000), ref: 00CAC9C4
                                                                                                                                                                                                        • _fputc.LIBCMT ref: 00CACDBD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fputc$ByteCharMultiWide
                                                                                                                                                                                                        • String ID: BUrl$CId$PId$SUrl
                                                                                                                                                                                                        • API String ID: 1324150907-2904165789
                                                                                                                                                                                                        • Opcode ID: ee9889181624009cde7e7f56d471a8a4a52ed24d0b88d9710893ccefa049d58d
                                                                                                                                                                                                        • Instruction ID: e4d3ec23b01b5ffa90a5750dc633e22f9abfc0d989a0d53c3afec24355424e75
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee9889181624009cde7e7f56d471a8a4a52ed24d0b88d9710893ccefa049d58d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 567108B09043417FDB54EF38CC81C2B7BA9EF57318B54062CF49687292EA22DD06D7A6
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8DCDA0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000001,?,?,00000000,?,?), ref: 6C8DCDFB
                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000400,00000001,00000001,00000003,<A>,00000003,00000000), ref: 6C8DCE3E
                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000400,00000001,00000001,00000004,</A>,00000004,00000000), ref: 6C8DCE7A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CompareString$lstrlen
                                                                                                                                                                                                        • String ID: </A>$<A>
                                                                                                                                                                                                        • API String ID: 1657112622-2122467442
                                                                                                                                                                                                        • Opcode ID: c0ae0c70fb1851add4411a7ea40a2ae453737736cd354b73b3fcb7691157092f
                                                                                                                                                                                                        • Instruction ID: e015d7b34e467d6167b80e558deaa5782fae621800b73c3d7ddd2920adb39433
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c0ae0c70fb1851add4411a7ea40a2ae453737736cd354b73b3fcb7691157092f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19318EB52083029FD321EF19D940B4BBBE1FF89318F114A59F9889B381C771E946CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB0CEF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00CB0CF6
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00CB0D21
                                                                                                                                                                                                          • Part of subcall function 00CB12BD: RaiseException.KERNEL32(?,?,00CB12BC,?,?,?,?,?,00CB12BC,?,00CCA734,00CCF11C,?,00CA5DB3,?), ref: 00CB12FF
                                                                                                                                                                                                        • InterlockedExchange.KERNEL32(00CCEFD8,00000000), ref: 00CB0D34
                                                                                                                                                                                                        • __free_locale.LIBCMT ref: 00CB0D45
                                                                                                                                                                                                          • Part of subcall function 00CB4BA1: __lock.LIBCMT ref: 00CB4BBA
                                                                                                                                                                                                          • Part of subcall function 00CB4BA1: InterlockedDecrement.KERNEL32(00000000), ref: 00CB4BCC
                                                                                                                                                                                                          • Part of subcall function 00CB4BA1: __lock.LIBCMT ref: 00CB4BFA
                                                                                                                                                                                                          • Part of subcall function 00CB4BA1: ___removelocaleref.LIBCMT ref: 00CB4C09
                                                                                                                                                                                                          • Part of subcall function 00CB4BA1: ___freetlocinfo.LIBCMT ref: 00CB4C22
                                                                                                                                                                                                          • Part of subcall function 00CB1481: __lock.LIBCMT ref: 00CB149F
                                                                                                                                                                                                          • Part of subcall function 00CB1481: ___sbh_find_block.LIBCMT ref: 00CB14AA
                                                                                                                                                                                                          • Part of subcall function 00CB1481: ___sbh_free_block.LIBCMT ref: 00CB14B9
                                                                                                                                                                                                          • Part of subcall function 00CB1481: HeapFree.KERNEL32(00000000,?,00CC9FB0,0000000C,00CB61F1,00000000,00CCA330,0000000C,00CB622B,?,?,?,00CBE303,00000004,00CCA5C0,0000000C), ref: 00CB14E9
                                                                                                                                                                                                          • Part of subcall function 00CB1481: GetLastError.KERNEL32(?,00CBE303,00000004,00CCA5C0,0000000C,00CB4532,?,?,00000000,00000000,00000000,?,00CB5D40,00000001,00000214), ref: 00CB14FA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • invalid string position, xrefs: 00CB0CFB
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __lock$Interlocked$DecrementErrorExceptionException@8ExchangeFreeH_prolog3HeapLastRaiseThrow___freetlocinfo___removelocaleref___sbh_find_block___sbh_free_block__free_locale
                                                                                                                                                                                                        • String ID: invalid string position
                                                                                                                                                                                                        • API String ID: 4001488440-1799206989
                                                                                                                                                                                                        • Opcode ID: 5b895324f2bad81bd1104e6757ddcc786f84639d5d0d34d12344c6d890bb7ef6
                                                                                                                                                                                                        • Instruction ID: 365fed419156c5278e3fed2532f463017cc4c21cc938a53837751c8ead276c93
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b895324f2bad81bd1104e6757ddcc786f84639d5d0d34d12344c6d890bb7ef6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46F02272A40218ABDB14A7E0EC89FCF6778EF50725F28002AF901F31D2CB61AE019260
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8CAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _rand$CountTick__getptd
                                                                                                                                                                                                        • String ID: %x%x%x%x
                                                                                                                                                                                                        • API String ID: 911611398-4006829457
                                                                                                                                                                                                        • Opcode ID: 8e3cf70db46a22519e6bee8ac0cd0c6316b6d9d7bb4a8a9fc6259cc7d8065811
                                                                                                                                                                                                        • Instruction ID: bb0610d825b02c653fb07707273902796125b668556c4dd8402464b2952b4120
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e3cf70db46a22519e6bee8ac0cd0c6316b6d9d7bb4a8a9fc6259cc7d8065811
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40018FB9208301EFD701DF99C949B5BB7E8EB94714F10891EE44987B90DB39D4048BA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C90EC10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90EC2A
                                                                                                                                                                                                          • Part of subcall function 6C910060: __getptd_noexit.LIBCMT ref: 6C910063
                                                                                                                                                                                                          • Part of subcall function 6C910060: __amsg_exit.LIBCMT ref: 6C910070
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90EC3B
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90EC49
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID: MOC$csm
                                                                                                                                                                                                        • API String ID: 803148776-1389381023
                                                                                                                                                                                                        • Opcode ID: b7fffee71b5d0c80b249cb4fa4cda36e7dd5b597860c6905c300c20fea6d042f
                                                                                                                                                                                                        • Instruction ID: f6ad9276715620be3444af9ad512f0352e130c747e28ec2609173f0a418f9bb5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b7fffee71b5d0c80b249cb4fa4cda36e7dd5b597860c6905c300c20fea6d042f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CE01A3624824CCFC710DA74C046B5932A9AB65328F5500A5E588C7B22C726D8949982
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8D4830 Relevance: 7.7, APIs: 5, Instructions: 172COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • PathFileExistsW.SHLWAPI(?,ECBB529E,00000088,00000090,?,00000000,6C93AF18,000000FF,6C8A9284,?,?,?,?,?,?,00000000), ref: 6C8D4880
                                                                                                                                                                                                        • _wcschr.LIBCMT ref: 6C8D4919
                                                                                                                                                                                                        • PathFileExistsW.SHLWAPI(?), ref: 6C8D4987
                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 6C8D4993
                                                                                                                                                                                                        • _wcschr.LIBCMT ref: 6C8D49AC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExistsFilePath_wcschr$CreateDirectory
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 774166180-0
                                                                                                                                                                                                        • Opcode ID: 2ec006cda9d8a633c0f60ca03cfb4e30a50d475cabb1993b3a5e9f01d61da6e7
                                                                                                                                                                                                        • Instruction ID: 2094a21332e35cc0d824d90a2efa0e82039e3491ac3c0fa401d7893c48f2fa77
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ec006cda9d8a633c0f60ca03cfb4e30a50d475cabb1993b3a5e9f01d61da6e7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C5105352082019FD710DF29CE40B9AB7E8EBC1228F154A7DE894D7B90D735FA09CBA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA6F60 Relevance: 7.6, APIs: 5, Instructions: 58threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 00CA6F78
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00CA6F85
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00CA6F9F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSection$CurrentEnterLeaveThread
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2351996187-0
                                                                                                                                                                                                        • Opcode ID: 95ad96c43f229580beafbcf40d720aad8c0f8fac1491138ac8e8b5ac650fb3bc
                                                                                                                                                                                                        • Instruction ID: 95e87696e4841ca87a256e64de51226f94bd5b0106a0c4630b4aeadab9812c2b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 95ad96c43f229580beafbcf40d720aad8c0f8fac1491138ac8e8b5ac650fb3bc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB01AD332052158F8764CF99FC84B9AF3A8FF98729305C52FE95A83614C731B885CBA4
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CBBD3B Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CBBD47
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __getptd_noexit.LIBCMT ref: 00CB5D91
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __amsg_exit.LIBCMT ref: 00CB5D9E
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 00CBBD67
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00CBBD77
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00CBBD94
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(027917F0), ref: 00CBBDBF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4271482742-0
                                                                                                                                                                                                        • Opcode ID: 73ca0e1dc54b26ac9bfe82514cb44f4947a92772a006dd77a07b58ac18678321
                                                                                                                                                                                                        • Instruction ID: 755a749fe9cbabb5f388ce42711b750287f72b4727fd3fcb1d2ecc0c0ff0fe62
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 73ca0e1dc54b26ac9bfe82514cb44f4947a92772a006dd77a07b58ac18678321
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1019631D40621ABCB24AB75D405BDDB360BF04B11F044115E92567699C7786E81DBD2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C910D85 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C910D91
                                                                                                                                                                                                          • Part of subcall function 6C910060: __getptd_noexit.LIBCMT ref: 6C910063
                                                                                                                                                                                                          • Part of subcall function 6C910060: __amsg_exit.LIBCMT ref: 6C910070
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 6C910DB1
                                                                                                                                                                                                        • __lock.LIBCMT ref: 6C910DC1
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 6C910DDE
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(026F1698), ref: 6C910E09
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4271482742-0
                                                                                                                                                                                                        • Opcode ID: bdf715d1f5a9be281c6052166d2419830b7e88ccd6044bcc0dab8610a570edd9
                                                                                                                                                                                                        • Instruction ID: af5d2d22c4f1f996cada9adde253f4ab01943cc650d77ee9c02d5e212883f240
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bdf715d1f5a9be281c6052166d2419830b7e88ccd6044bcc0dab8610a570edd9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F014431A0A799DBEB41AB66800639D73B0BF21728F216009E800A7F80CB31E465CBD5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB1481 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00CB149F
                                                                                                                                                                                                          • Part of subcall function 00CB6210: __mtinitlocknum.LIBCMT ref: 00CB6226
                                                                                                                                                                                                          • Part of subcall function 00CB6210: __amsg_exit.LIBCMT ref: 00CB6232
                                                                                                                                                                                                          • Part of subcall function 00CB6210: EnterCriticalSection.KERNEL32(?,?,?,00CBE303,00000004,00CCA5C0,0000000C,00CB4532,?,?,00000000,00000000,00000000,?,00CB5D40,00000001), ref: 00CB623A
                                                                                                                                                                                                        • ___sbh_find_block.LIBCMT ref: 00CB14AA
                                                                                                                                                                                                        • ___sbh_free_block.LIBCMT ref: 00CB14B9
                                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,00CC9FB0,0000000C,00CB61F1,00000000,00CCA330,0000000C,00CB622B,?,?,?,00CBE303,00000004,00CCA5C0,0000000C), ref: 00CB14E9
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00CBE303,00000004,00CCA5C0,0000000C,00CB4532,?,?,00000000,00000000,00000000,?,00CB5D40,00000001,00000214), ref: 00CB14FA
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2714421763-0
                                                                                                                                                                                                        • Opcode ID: f2d7fe238eae230058bb8436c288e55bced209b38858dea55de055cc91010a13
                                                                                                                                                                                                        • Instruction ID: 75f575a4e5abebb9d5a7aad5ec3d5aeb630d995301429acc5766f82f4bfb9b7a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2d7fe238eae230058bb8436c288e55bced209b38858dea55de055cc91010a13
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C401D672904311EFDF387FF1DC1ABDE3B68AF01365F588518F925A6091EB388A409A95
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E0CD0 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,00000203,?,?), ref: 6C8E0CE4
                                                                                                                                                                                                        • GetCapture.USER32 ref: 6C8E0CF0
                                                                                                                                                                                                        • SetCapture.USER32(?,?,6C8E11B7), ref: 6C8E0CFB
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001,6C8E11B7), ref: 6C8E0D17
                                                                                                                                                                                                        • UpdateWindow.USER32(?), ref: 6C8E0D21
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CaptureWindow$CallInvalidateProcRectUpdate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4144783842-0
                                                                                                                                                                                                        • Opcode ID: e6a611665dc466c7a8969966790bf3044be07bf4db7af0a2773da99dbd59ce82
                                                                                                                                                                                                        • Instruction ID: 36c7982340f0b0cb58cbca355eff3dd1a7d5f1063c6782102a35f80926feb5ed
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e6a611665dc466c7a8969966790bf3044be07bf4db7af0a2773da99dbd59ce82
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1BF0FFB5314B409BD720AB69DA8CE1777F9FB89B19B108D18F55AC3A40C771F8418720
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C89A8D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 180COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset
                                                                                                                                                                                                        • String ID: Set-Cookie$date
                                                                                                                                                                                                        • API String ID: 2102423945-604734490
                                                                                                                                                                                                        • Opcode ID: 83fdf863f6c912b3f5d87a20347cfc9faa850252bbd5474fd8f33350fca8a23f
                                                                                                                                                                                                        • Instruction ID: 2f1529a12f6fc44ec172787af56c3faad9678c0e8aa936ae413dc76f9135f7ae
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 83fdf863f6c912b3f5d87a20347cfc9faa850252bbd5474fd8f33350fca8a23f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C617E716083809FD324CF59C980E9BB7E9AFD9354F108A2DF59987790D771E908CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F2E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C8DD050: _memset.LIBCMT ref: 6C8DD0AA
                                                                                                                                                                                                          • Part of subcall function 6C8DD050: CreateFontIndirectW.GDI32(?), ref: 6C8DD0D8
                                                                                                                                                                                                        • GetSysColor.USER32(00000008), ref: 6C8F2E89
                                                                                                                                                                                                        • GetSysColorBrush.USER32(00000005), ref: 6C8F2E93
                                                                                                                                                                                                        • GetSysColor.USER32(00000005), ref: 6C8F2EA1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$BrushCreateFontIndirect_memset
                                                                                                                                                                                                        • String ID: cab
                                                                                                                                                                                                        • API String ID: 1438168956-1787492089
                                                                                                                                                                                                        • Opcode ID: f8082e82981848a5807ab5277de07095e64a45211ee0bb896c7b01d21a468e42
                                                                                                                                                                                                        • Instruction ID: 92842451133aaa9af874ee495518fc2c6ba20f8d813750c6be03419e42bf0559
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f8082e82981848a5807ab5277de07095e64a45211ee0bb896c7b01d21a468e42
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B6156B0A05B42AFD348CF3AC9817C5FBE4BB49710F90862E956C87641E770A564CFD5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8EEE00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C8DD050: _memset.LIBCMT ref: 6C8DD0AA
                                                                                                                                                                                                          • Part of subcall function 6C8DD050: CreateFontIndirectW.GDI32(?), ref: 6C8DD0D8
                                                                                                                                                                                                        • GetSysColor.USER32(00000008), ref: 6C8EEE49
                                                                                                                                                                                                        • GetSysColorBrush.USER32(00000005), ref: 6C8EEE53
                                                                                                                                                                                                        • GetSysColor.USER32(00000005), ref: 6C8EEE61
                                                                                                                                                                                                          • Part of subcall function 6C8F0F90: InterlockedExchange.KERNEL32(000005B5,00000002), ref: 6C8F0FE8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$BrushCreateExchangeFontIndirectInterlocked_memset
                                                                                                                                                                                                        • String ID: cab
                                                                                                                                                                                                        • API String ID: 2063082884-1787492089
                                                                                                                                                                                                        • Opcode ID: e64918d6b0fbce402aa93c594d6e509cf0f766c29c08dbeb42b580f500ff8ac0
                                                                                                                                                                                                        • Instruction ID: 6a82529d2f09e81c6321c0d4d8d77606b0f938b90f57e585333654df0cf7223c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e64918d6b0fbce402aa93c594d6e509cf0f766c29c08dbeb42b580f500ff8ac0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D15166B1A44A42AFD348CF3AC9857D6FBE4BB49714F90872E946C87A50D770A564CFC0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAD240 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00CAD263
                                                                                                                                                                                                          • Part of subcall function 00CA7670: std::_String_base::_Xlen.LIBCPMT ref: 00CA76C2
                                                                                                                                                                                                          • Part of subcall function 00CA7670: _memcpy_s.LIBCMT ref: 00CA773E
                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 00CAD32A
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00CAD334
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AttributesCreateDirectoryErrorFileLastString_base::_Xlen_memcpy_sstd::_
                                                                                                                                                                                                        • String ID: \
                                                                                                                                                                                                        • API String ID: 3521624377-2967466578
                                                                                                                                                                                                        • Opcode ID: 611ae10988c41794ae2334366df290b6ef318eb721b4dd17b8dffbc04e20c3ac
                                                                                                                                                                                                        • Instruction ID: 4dc34ed129b4a861328c3179723bfb232b86f05463ac6eb49ae3cc80dde1ee45
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 611ae10988c41794ae2334366df290b6ef318eb721b4dd17b8dffbc04e20c3ac
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE31C7B15083019BD704DF24DC52BAF73E5AF96358F844A1CF067821A2E730D909CB93
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAF0B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CAEBD0: _memset.LIBCMT ref: 00CAEC25
                                                                                                                                                                                                          • Part of subcall function 00CAEBD0: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00CAEC36
                                                                                                                                                                                                          • Part of subcall function 00CAEBD0: lstrcatW.KERNEL32(?,\360wp\User Data\), ref: 00CAEC45
                                                                                                                                                                                                          • Part of subcall function 00CAEBD0: GetFileAttributesW.KERNEL32(?), ref: 00CAEC9C
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00CAF105
                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?), ref: 00CAF11F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Attributes$DeleteFolderPath_memsetlstrcat
                                                                                                                                                                                                        • String ID: 360WPFav.json$360WPFavTmp.json
                                                                                                                                                                                                        • API String ID: 3353134414-1138631119
                                                                                                                                                                                                        • Opcode ID: 026e2c3b30eb80acf6e583f83f423eba4d34448c5b84ef8a690cc70ba389474c
                                                                                                                                                                                                        • Instruction ID: c7378ec011ffb549902f26d3d0c4b2391e9045acaa25d98acce95fcab691ecc0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 026e2c3b30eb80acf6e583f83f423eba4d34448c5b84ef8a690cc70ba389474c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1621CF70904300ABCB04EFA4D886B1F77E0AF85718F94492DF44A47291EB35E946CBD3
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB5370 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___BuildCatchObject.LIBCMT ref: 00CB5383
                                                                                                                                                                                                          • Part of subcall function 00CB52DE: ___BuildCatchObjectHelper.LIBCMT ref: 00CB5314
                                                                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 00CB539A
                                                                                                                                                                                                        • ___FrameUnwindToState.LIBCMT ref: 00CB53A8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                        • API String ID: 2163707966-1018135373
                                                                                                                                                                                                        • Opcode ID: 59baf14bbd5d0f73da16029d8ac76daf63348b36618b9fc2de3fd4759461a68c
                                                                                                                                                                                                        • Instruction ID: 2bd93dfcb26a81d2beca0609bbbb30a5729c60c579deb989beda2d1a8eef0320
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 59baf14bbd5d0f73da16029d8ac76daf63348b36618b9fc2de3fd4759461a68c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F301E471001509BBDF126F51CC45EEA7FAAEF08390F144110FD2915261D776DAA1EBA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB7F21 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(KERNEL32,00CB1A85), ref: 00CB7F26
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00CB7F36
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleModuleProc
                                                                                                                                                                                                        • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                                        • API String ID: 1646373207-3105848591
                                                                                                                                                                                                        • Opcode ID: 006e2319f6a79110b13cdd5269e01f5d9085d00ebed3b7c6a055e94a12375f34
                                                                                                                                                                                                        • Instruction ID: 8314b27a6bd55bc50736e014aeacf97e5abdc0e2a13a567620ddfc4da86a5883
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 006e2319f6a79110b13cdd5269e01f5d9085d00ebed3b7c6a055e94a12375f34
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 21F03020A48A0DD7DB002BA2ED0EBAE7BB8FBC0742F9206D0D5A5A10C4DF308075D755
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C9249F0 Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C924040: LoadLibraryW.KERNEL32(WINTRUST.DLL,ECBB529E,?,?,00000000,?), ref: 6C924093
                                                                                                                                                                                                          • Part of subcall function 6C924040: GetProcAddress.KERNEL32(?,WinVerifyTrust), ref: 6C9240C3
                                                                                                                                                                                                          • Part of subcall function 6C924040: GetProcAddress.KERNEL32(?,CryptCATAdminCalcHashFromFileHandle), ref: 6C9240D1
                                                                                                                                                                                                          • Part of subcall function 6C924040: GetProcAddress.KERNEL32(?,CryptCATAdminAcquireContext), ref: 6C9240DF
                                                                                                                                                                                                          • Part of subcall function 6C924040: GetProcAddress.KERNEL32(?,CryptCATAdminReleaseContext), ref: 6C9240ED
                                                                                                                                                                                                          • Part of subcall function 6C924040: GetProcAddress.KERNEL32(?,CryptCATAdminEnumCatalogFromHash), ref: 6C9240FB
                                                                                                                                                                                                          • Part of subcall function 6C924040: GetProcAddress.KERNEL32(?,CryptCATAdminReleaseCatalogContext), ref: 6C924109
                                                                                                                                                                                                          • Part of subcall function 6C924040: GetProcAddress.KERNEL32(?,CryptCATCatalogInfoFromContext), ref: 6C924117
                                                                                                                                                                                                          • Part of subcall function 6C924040: LoadLibraryW.KERNEL32(Crypt32.dll), ref: 6C924171
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C924AB2
                                                                                                                                                                                                        • WTHelperProvDataFromStateData.WINTRUST(?), ref: 6C924B49
                                                                                                                                                                                                        • WTHelperGetProvSignerFromChain.WINTRUST(00000000,00000000,00000000,00000000,?), ref: 6C924B59
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C924B83
                                                                                                                                                                                                          • Part of subcall function 6C921820: GetLastError.KERNEL32(?,00000000,00000001,?,6C924308,-00000034,1.3.6.1.4.1.311.2.1.12,00000000,?,00000000,ECBB529E,?,?,00000000,00000000,?), ref: 6C921824
                                                                                                                                                                                                          • Part of subcall function 6C921820: SetLastError.KERNEL32(00000000,?,6C924308,-00000034,1.3.6.1.4.1.311.2.1.12,00000000,?,00000000,ECBB529E,?,?,00000000,00000000,?), ref: 6C921842
                                                                                                                                                                                                          • Part of subcall function 6C921820: __CxxThrowException@8.LIBCMT ref: 6C921865
                                                                                                                                                                                                          • Part of subcall function 6C921820: __CxxThrowException@8.LIBCMT ref: 6C92187B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressProc$DataErrorException@8FromHelperLastLibraryLoadProvThrow_memset$ChainSignerState
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 517739681-0
                                                                                                                                                                                                        • Opcode ID: 83e619a0fbe3c028b4d1dbdcd9d8525776decf7c2ca6a791eb5582cc4ff3bfc9
                                                                                                                                                                                                        • Instruction ID: 782ff5c19fb3f2f671b6db919d21822bbba41497e61d11362d5b18d1af129801
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 83e619a0fbe3c028b4d1dbdcd9d8525776decf7c2ca6a791eb5582cc4ff3bfc9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41517B71E102499FDB04CFA8C855BEEBBB8EF58314F24421AE854AB785D779D904CFA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8FE8C0 Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memmove_s.LIBCMT ref: 6C8FE954
                                                                                                                                                                                                        • _memmove_s.LIBCMT ref: 6C8FE980
                                                                                                                                                                                                          • Part of subcall function 6C8FF7D0: __CxxThrowException@8.LIBCMT ref: 6C8FF846
                                                                                                                                                                                                        • _memmove_s.LIBCMT ref: 6C8FE9C5
                                                                                                                                                                                                        • _memmove_s.LIBCMT ref: 6C8FE9F0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memmove_s$Exception@8Throw
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2992690706-0
                                                                                                                                                                                                        • Opcode ID: 8393ce03613bc0a9701369948a2b56e0cc772eb096466f8217787b1199a4267b
                                                                                                                                                                                                        • Instruction ID: 8108836e0bbd8fc11d7b09a950fb4ba307e567f6d5e9236f4a9979cfc67ff3fd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8393ce03613bc0a9701369948a2b56e0cc772eb096466f8217787b1199a4267b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8141BE71B002155BEB28CF28CD9166B73A9EB90344F444E2CEC65D7B05E735F9168BE2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F29C0 Relevance: 6.1, APIs: 4, Instructions: 131windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6C8F2A8B
                                                                                                                                                                                                        • BeginPaint.USER32(?,?,ECBB529E), ref: 6C8F2AB4
                                                                                                                                                                                                          • Part of subcall function 6C8FBE70: GetClientRect.USER32(?), ref: 6C8FBE86
                                                                                                                                                                                                          • Part of subcall function 6C8FBE70: GetObjectW.GDI32 ref: 6C8FBEB8
                                                                                                                                                                                                          • Part of subcall function 6C8FBE70: DeleteObject.GDI32(00000000), ref: 6C8FBEE5
                                                                                                                                                                                                          • Part of subcall function 6C8FBE70: CreateCompatibleBitmap.GDI32(?,?,?), ref: 6C8FBF21
                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 6C8F2B57
                                                                                                                                                                                                          • Part of subcall function 6C8D5B20: GetObjectW.GDI32 ref: 6C8D5B4E
                                                                                                                                                                                                          • Part of subcall function 6C8D5B20: CreateCompatibleDC.GDI32(?), ref: 6C8D5B6E
                                                                                                                                                                                                          • Part of subcall function 6C8D5B20: SelectObject.GDI32(00000000,?), ref: 6C8D5B78
                                                                                                                                                                                                        • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6C8F2B3E
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: GetClientRect.USER32(?,?), ref: 6C8E763A
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: CreateCompatibleDC.GDI32(?), ref: 6C8E764A
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: SelectObject.GDI32(00000000,?), ref: 6C8E7663
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: SelectObject.GDI32(00000000,?), ref: 6C8E76B6
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 6C8E76DE
                                                                                                                                                                                                          • Part of subcall function 6C8E75F0: SelectObject.GDI32(00000000,?), ref: 6C8E77DB
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$Select$CompatibleCreate$ClientPaintRect$BeginBitmapDelete
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1471506585-0
                                                                                                                                                                                                        • Opcode ID: ee8935697c5470b48847bba2d224457840f3be93f80dfae2efbac0ac2b80749a
                                                                                                                                                                                                        • Instruction ID: 781019183c60d0fb2feee89110cc1c877cd2ff95e01e7305b843aa4d147cade7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee8935697c5470b48847bba2d224457840f3be93f80dfae2efbac0ac2b80749a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7515EB1208341DFD724CF14C945B5BBBE4FB88748F21892DF999A7741D734E9098BA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAA960 Relevance: 6.1, APIs: 4, Instructions: 124COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fgetc$_malloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1464708783-0
                                                                                                                                                                                                        • Opcode ID: 9a474e0905b9508452663ee0a699a677cb2042893b3a3f2f45ce0e18328e5468
                                                                                                                                                                                                        • Instruction ID: 2e6056d28ca5d70127ddf2adf563ffaeb34136342396b2aefab4378ccb453d4c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a474e0905b9508452663ee0a699a677cb2042893b3a3f2f45ce0e18328e5468
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B941E6716053019FE724DF28C845A6BB7A4EF96328F14C51EF9A647382D731EC09DBA2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CBF61B Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CBF64F
                                                                                                                                                                                                        • __isleadbyte_l.LIBCMT ref: 00CBF683
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 00CBF6B4
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 00CBF722
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3058430110-0
                                                                                                                                                                                                        • Opcode ID: b0f2250a843cf1691658734de6cc820a515a48f9337d7acf220f3e244f8faf46
                                                                                                                                                                                                        • Instruction ID: 5e75264e99c9bf730fa30f8ff72fe2bdb3ff838534e235828a019503d3e6c1c2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b0f2250a843cf1691658734de6cc820a515a48f9337d7acf220f3e244f8faf46
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B319E31A04246EFDB20DF64CC81AEE7BA5AF01310F1485BDF8A19B2A1E730DE52DB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8C6D60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$DestroyGdiplusShutdown
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 859624117-0
                                                                                                                                                                                                        • Opcode ID: 7e1d302165260df75a3e50cf8d75a776e60c9e5073e9ca9b10f552f7c010dfa6
                                                                                                                                                                                                        • Instruction ID: da9b8b1b41c8bdef4d468d306c25e6ea1e4ada4e170efd34bf38b89bcbda9427
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e1d302165260df75a3e50cf8d75a776e60c9e5073e9ca9b10f552f7c010dfa6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E03192756017018FD724DFA9C980A6AF7E6BF88214F658A2ED26AD7740C731E841CBA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CACDF0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _longjmp$__setjmp3
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 83484782-0
                                                                                                                                                                                                        • Opcode ID: 017ee3c7222f0f947eee1ec4ca793a9b6f202665f912bcb38b9caf4c5729687a
                                                                                                                                                                                                        • Instruction ID: b75fa004d48f0d35576b78432a16416c3200f8b60050018c0c1312c607efe1b8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 017ee3c7222f0f947eee1ec4ca793a9b6f202665f912bcb38b9caf4c5729687a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E82100B5900204AFDB04DF58CC86BAEB7A8EF42315F14808EEC005B312D775EE42DBA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA8090 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __recalloc_memmove_s
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1992126439-0
                                                                                                                                                                                                        • Opcode ID: 64c53e6fb16fed6d76d7819a64118f8e0847e64dc3074850ee709fdb43d1d15a
                                                                                                                                                                                                        • Instruction ID: 130df937ba80daf03ea952695dc3c88f8c776888942ee1c5aea6b5c0a0e31780
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 64c53e6fb16fed6d76d7819a64118f8e0847e64dc3074850ee709fdb43d1d15a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D21C9B66007025FC330DA69CC85DABB3EAEFD5314B18C81DE996C7644EE31E946C760
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8DAF80 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C8FB770: ImageList_LoadImageW.COMCTL32(6C890000,000000CF,0000002F,?,000000FF,?,00002000,?), ref: 6C8FB82A
                                                                                                                                                                                                          • Part of subcall function 6C8FB770: IsWindow.USER32(?), ref: 6C8FB842
                                                                                                                                                                                                        • ImageList_LoadImageW.COMCTL32(6C890000,000000D5,00000029,?,FF000000,?,00002000), ref: 6C8DAFDC
                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,000000EE,000000AA,00000006), ref: 6C8DB011
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 6C8DB04C
                                                                                                                                                                                                        • GetParent.USER32 ref: 6C8DB067
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Image$Window$List_Load$ParentText
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2556169411-0
                                                                                                                                                                                                        • Opcode ID: 22466582e300fe53ee7c248d6c2c631ad2f19462d785733056ab4b2d18409173
                                                                                                                                                                                                        • Instruction ID: 17f906bf65bf37becd50294e8ee4ac595d84b44ace1aeb807e583fa5679c6484
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 22466582e300fe53ee7c248d6c2c631ad2f19462d785733056ab4b2d18409173
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1021B271744300AFE720AB74CD49BA677B8BB45318F254A69E954E77C0D770F804CBA5
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8DA990 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 6C8DA99F
                                                                                                                                                                                                        • SetRect.USER32(?,00000014,0000002D,0000003C,00000055), ref: 6C8DA9BA
                                                                                                                                                                                                        • SetRect.USER32(?,00000050,00000032,000000DA,0000007D), ref: 6C8DA9CE
                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,?,?,0000003C,00000018,00000004), ref: 6C8DAA4C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Rect$ClientWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 23228050-0
                                                                                                                                                                                                        • Opcode ID: 8cc677f393d82293763ce3361d97fc8648d0bdc68735f43b072adab9b8225ceb
                                                                                                                                                                                                        • Instruction ID: 0493ba77dd319f58a05f7fbbadd07fe93456a6318e8240b2fd34c4b3cce66d90
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8cc677f393d82293763ce3361d97fc8648d0bdc68735f43b072adab9b8225ceb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9521F1326407019BD720DE68CE85F9677A8FB84B10F044A78FE54AF2C5D770E9048BA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8DEF60 Relevance: 6.1, APIs: 4, Instructions: 65windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClientRect.USER32(?), ref: 6C8DEF76
                                                                                                                                                                                                        • GetObjectW.GDI32 ref: 6C8DEFA8
                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 6C8DEFD5
                                                                                                                                                                                                        • CreateCompatibleBitmap.GDI32(?,?,?), ref: 6C8DF011
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$BitmapClientCompatibleCreateDeleteRect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2837697248-0
                                                                                                                                                                                                        • Opcode ID: dbbaee5e350cd994486e4de513a7da26580a99c66d46c7af8595cf6b7bcb96f9
                                                                                                                                                                                                        • Instruction ID: 751e014f1179431b229172037c80162c3c476a8323bd27e4d10aefee831bec67
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dbbaee5e350cd994486e4de513a7da26580a99c66d46c7af8595cf6b7bcb96f9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E21A070609302DFD764DF29C684A1ABBE5BF98709F218A2DF4D9C3640D730E984CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA8A20 Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CA8A3D
                                                                                                                                                                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CA8A5F
                                                                                                                                                                                                        • TranslateMessage.USER32(?), ref: 00CA8A7C
                                                                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 00CA8A83
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message$DispatchPeekTranslate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4217535847-0
                                                                                                                                                                                                        • Opcode ID: d62150b2b7b30aa5f467288524f334b274abfddda24185231f7191c11c5bae6a
                                                                                                                                                                                                        • Instruction ID: 520c4b99beaa2bd9b6522528ba51f7d0870c3c2aaee984bc5aad4641b77c852d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d62150b2b7b30aa5f467288524f334b274abfddda24185231f7191c11c5bae6a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 831126353002066BE2345A59DC89F3FB3A8EF87B48F24451BF262D71D0DFA4ED09A250
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB7DEC Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3016257755-0
                                                                                                                                                                                                        • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                        • Instruction ID: f2bc5d042eaa5e332acb6ade0fcdf606ce090ee0d4edee4a1ce8c2d2378edc98
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D11283200818ABFCF125E84CC42CEE3F62BF98350F598655FE2859521C736CAB1AB81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8EE800 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowRgn.USER32(?,00000000), ref: 6C8EE822
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 6C8EE831
                                                                                                                                                                                                        • CreateRoundRectRgn.GDI32(?,?,?,?,000000FF,000000FF), ref: 6C8EE856
                                                                                                                                                                                                        • SetWindowRgn.USER32(?,00000000,00000001), ref: 6C8EE863
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: RectWindow$ClientCreateRound
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2220218125-0
                                                                                                                                                                                                        • Opcode ID: 9d1ce7713fc676b4dd00e92a48cb1df05304211d9c954d21bb37485a3ca4acc5
                                                                                                                                                                                                        • Instruction ID: a239c59ecaa385bdc06b95cf42073b0e96a7ff9507f8fefa7d1075767c099740
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d1ce7713fc676b4dd00e92a48cb1df05304211d9c954d21bb37485a3ca4acc5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 180152B6604715AFD710EE54CD4CD67B7BCEB8A715F10891CFA6193180C670E80ACB71
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CAB830 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 00CAB866
                                                                                                                                                                                                        • FlushInstructionCache.KERNEL32(00000000), ref: 00CAB86D
                                                                                                                                                                                                        • CreateDialogParamW.USER32(00CA0000,000000CD,000000E9,Function_0000B600,?), ref: 00CAB89D
                                                                                                                                                                                                          • Part of subcall function 00CB0AD9: GetProcessHeap.KERNEL32(00000000,0000000D,?,00CA6FFE), ref: 00CB0A5A
                                                                                                                                                                                                          • Part of subcall function 00CB0AD9: HeapAlloc.KERNEL32(00000000,?,00CA6FFE), ref: 00CB0A61
                                                                                                                                                                                                        • SetLastError.KERNEL32(0000000E), ref: 00CAB8A9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HeapProcess$AllocCacheCreateCurrentDialogErrorFlushInstructionLastParam
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3830230333-0
                                                                                                                                                                                                        • Opcode ID: 3349bbab5ccc4115338bbd2d6259b93dcdcd90aafc79fb1034c4c0d18c27d5d9
                                                                                                                                                                                                        • Instruction ID: 7820c5e32e4632bd55c3228e900269c2ba3ffd7c5670cc8b13639164a5ee79aa
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3349bbab5ccc4115338bbd2d6259b93dcdcd90aafc79fb1034c4c0d18c27d5d9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4701DB71204301AFE324AFB8EC19F5B7AA8EF56715F068A1AF4469B290CB70D800C770
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8EE880 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 6C8EE89E
                                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6C8EE8A4
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 6C8EE8B7
                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,?,00000000,000000FF,000000FF,00000005), ref: 6C8EE8D8
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClientRectWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2195062447-0
                                                                                                                                                                                                        • Opcode ID: 7b9c1cc20cccad5ed4156343b465fbae824813e5231c76bf84d640e4b3239f76
                                                                                                                                                                                                        • Instruction ID: f9dced6f2a7aaa3cbd20650524d1f939a568d71ee9302b326730a5df8c4e7246
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7b9c1cc20cccad5ed4156343b465fbae824813e5231c76bf84d640e4b3239f76
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93F06D71604722ABD714DE68CD88E5BB3F8BF89B14F218A0CF560936D4D730E805CB60
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CA7050 Relevance: 6.0, APIs: 4, Instructions: 32threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RaiseException.KERNEL32(C0000005,00000001,00000000,00000000), ref: 00CA7066
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00CA707E
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 00CA708B
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00CA709B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSection$CurrentEnterExceptionLeaveRaiseThread
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2662421713-0
                                                                                                                                                                                                        • Opcode ID: 99e2eae8bd0e34141d83b340bd0d54414358d8b2263f679d94ade287933dea33
                                                                                                                                                                                                        • Instruction ID: 5b1a07a5e166696dedcfc8933a9df062de1f62b3151256a471ec7f9cfd1ce848
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99e2eae8bd0e34141d83b340bd0d54414358d8b2263f679d94ade287933dea33
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1BF03A72604702DBD7209F65DC88F4BBBA8FF55B15F01C41EFA999B250C370E8458BA1
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB4B2B Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB4B37
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __getptd_noexit.LIBCMT ref: 00CB5D91
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __amsg_exit.LIBCMT ref: 00CB5D9E
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB4B4E
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 00CB4B5C
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00CB4B6C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3521780317-0
                                                                                                                                                                                                        • Opcode ID: 63ee5b56777def7bc14998720bd69488f80f6a88ec0c3943680606541473e27c
                                                                                                                                                                                                        • Instruction ID: 0d8d247b45588dc8aa1f6860373f2a327b51c7f624cb399c4906c69a8e55c217
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 63ee5b56777def7bc14998720bd69488f80f6a88ec0c3943680606541473e27c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8F09032948B048BD728FF78C40ABDDB2A0AB04710F104119E664A72D3CB34D900AA56
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C928800 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 182COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C928200: GetFileSizeEx.KERNEL32(?,?,?,?,00000002,00000000,?,?,00000000,?,?,?,00000001,?,?,?), ref: 6C92821D
                                                                                                                                                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C92897C
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C928992
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileSizeUnothrow_t@std@@@__ehfuncinfo$??2@_memset
                                                                                                                                                                                                        • String ID: .\QHImageHlp.c
                                                                                                                                                                                                        • API String ID: 1162039467-3639949391
                                                                                                                                                                                                        • Opcode ID: a279f6d4d3ebbca1ef4fb2321d60ed5dd8d3a77993ff2846960d48de15319169
                                                                                                                                                                                                        • Instruction ID: 8bc36c88884c77d703d2fae277ec0850e6b76ec0325edcac3ce6460c16360d49
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a279f6d4d3ebbca1ef4fb2321d60ed5dd8d3a77993ff2846960d48de15319169
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E451B6B2A043059FD304DF55C880A5BF7E8FF98308F44892EF59883B15E334E9498B92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C904F30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: swprintf
                                                                                                                                                                                                        • String ID: %$+
                                                                                                                                                                                                        • API String ID: 233258989-2626897407
                                                                                                                                                                                                        • Opcode ID: 679c812ce4a92dd6921cf5d7bf2196ab1d41a9ef305d52c6f4d4dfa3b8af9597
                                                                                                                                                                                                        • Instruction ID: 2a6f4711b2b7d9632eea17ba532e595b92b1bbb9dfa1338374effd17e3ae1b30
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 679c812ce4a92dd6921cf5d7bf2196ab1d41a9ef305d52c6f4d4dfa3b8af9597
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F516673B08340ABD302AE48C8847DB7BFCEB52744F244E5CE98693691E769C9548BD6
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8B6F00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 155COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8B6F5A
                                                                                                                                                                                                          • Part of subcall function 6C8D46B0: _wcsncpy.LIBCMT ref: 6C8D4708
                                                                                                                                                                                                          • Part of subcall function 6C8D46B0: __wcstoi64.LIBCMT ref: 6C8D4716
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcstoi64_memset_wcsncpy
                                                                                                                                                                                                        • String ID: X-sig$check md5 fail
                                                                                                                                                                                                        • API String ID: 3163217345-3512512966
                                                                                                                                                                                                        • Opcode ID: e1fa6d94632c78f2fcf6de8acc01d60692616a9377aaeb2b98bcd3c717a0b48a
                                                                                                                                                                                                        • Instruction ID: a5733d9bff12495a4639fe8dbeea2e540a9b03a0433e3820b22d745f96a76ee4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e1fa6d94632c78f2fcf6de8acc01d60692616a9377aaeb2b98bcd3c717a0b48a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 69514C712083409FD364CF68C880B5BB7E9FB89314F514A2EE999DB791DB70E905CB92
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C9068F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _localeconv.LIBCMT ref: 6C90691E
                                                                                                                                                                                                          • Part of subcall function 6C90C14E: __getptd.LIBCMT ref: 6C90C14E
                                                                                                                                                                                                          • Part of subcall function 6C908536: ____lc_handle_func.LIBCMT ref: 6C908539
                                                                                                                                                                                                          • Part of subcall function 6C908536: ____lc_codepage_func.LIBCMT ref: 6C908541
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ____lc_codepage_func____lc_handle_func__getptd_localeconv
                                                                                                                                                                                                        • String ID: false$true
                                                                                                                                                                                                        • API String ID: 679402580-2658103896
                                                                                                                                                                                                        • Opcode ID: eac967d1fb4587013bd294939144dd49239c480be252948cf006e0922900661f
                                                                                                                                                                                                        • Instruction ID: 0a8bd9a90aa92ad68e9c4a2c79683093e0057b482a17aac5c65301ba941872a3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eac967d1fb4587013bd294939144dd49239c480be252948cf006e0922900661f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD414976B086918FCB06CF388454696BBE5AF66358B1881ADCC95DFB01E731D50AC7E0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8B4800 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 6C8B4870
                                                                                                                                                                                                          • Part of subcall function 6C90A3B5: __wcstoi64.LIBCMT ref: 6C90A3AB
                                                                                                                                                                                                          • Part of subcall function 6C908E94: __lock.LIBCMT ref: 6C908EB2
                                                                                                                                                                                                          • Part of subcall function 6C908E94: ___sbh_find_block.LIBCMT ref: 6C908EBD
                                                                                                                                                                                                          • Part of subcall function 6C908E94: ___sbh_free_block.LIBCMT ref: 6C908ECC
                                                                                                                                                                                                          • Part of subcall function 6C908E94: RtlFreeHeap.NTDLL(00000000,00000000,6C9537C8,0000000C,6C911500,00000000,6C953CC0,0000000C,6C91153A,00000000,?,?,6C912097,00000004,6C953CE0,0000000C), ref: 6C908EFC
                                                                                                                                                                                                          • Part of subcall function 6C908E94: GetLastError.KERNEL32(?,6C912097,00000004,6C953CE0,0000000C,6C90EA00,00000000,?,00000000,00000000,00000000,?,6C910012,00000001,00000214), ref: 6C908F0D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock__wcstoi64_memset
                                                                                                                                                                                                        • String ID: X-errmsg$X-errno
                                                                                                                                                                                                        • API String ID: 3090071423-2960631205
                                                                                                                                                                                                        • Opcode ID: 75546e14f00d9504da7915d8dc79516a8b75b915a776e57dabbafcc2d26436f6
                                                                                                                                                                                                        • Instruction ID: 5196501c4b574cd9b3439d115f74bca7e0f75f214211bc98d711e9786576fc9d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75546e14f00d9504da7915d8dc79516a8b75b915a776e57dabbafcc2d26436f6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96518F712083419FE724CB18C981F9BB3E9AFD9314F104A1DE5999B781DB70E908CB96
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB50E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CB18BE: __getptd.LIBCMT ref: 00CB18C4
                                                                                                                                                                                                          • Part of subcall function 00CB18BE: __getptd.LIBCMT ref: 00CB18D4
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB50F8
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __getptd_noexit.LIBCMT ref: 00CB5D91
                                                                                                                                                                                                          • Part of subcall function 00CB5D8E: __amsg_exit.LIBCMT ref: 00CB5D9E
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00CB5106
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                        • API String ID: 803148776-1018135373
                                                                                                                                                                                                        • Opcode ID: 34c2cdd0cdf21a83f257d5f6e3c174721c8a126ac6ee8bbaa7026b0c54436422
                                                                                                                                                                                                        • Instruction ID: a675f1be22b7fe36854ae8097e5ed333da17854c240f0cb798693914c5645c7e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34c2cdd0cdf21a83f257d5f6e3c174721c8a126ac6ee8bbaa7026b0c54436422
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B018B31801A058FCF34DF28D4547EDB3B5BF18311F54166DE460966A1CB328E85DF40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C90EFFA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 6C90C88B: __getptd.LIBCMT ref: 6C90C891
                                                                                                                                                                                                          • Part of subcall function 6C90C88B: __getptd.LIBCMT ref: 6C90C8A1
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90F009
                                                                                                                                                                                                          • Part of subcall function 6C910060: __getptd_noexit.LIBCMT ref: 6C910063
                                                                                                                                                                                                          • Part of subcall function 6C910060: __amsg_exit.LIBCMT ref: 6C910070
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 6C90F017
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                        • API String ID: 803148776-1018135373
                                                                                                                                                                                                        • Opcode ID: 527bb48396f7858fe19b399785dfb76e42cb4b5337b86753a910bcfed3fadf68
                                                                                                                                                                                                        • Instruction ID: 38fd232c259ed52abb2dfbe1bfe29bb9a819fb6d98540de7c680c91a2029ebd6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 527bb48396f7858fe19b399785dfb76e42cb4b5337b86753a910bcfed3fadf68
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C901AD70A01706CECB248F21D4406AEB3BABF20B1EF64452DD48056E51EB31D694CB59
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB0270 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00CAFD00: FindResourceW.KERNEL32(00CA0000,?,?), ref: 00CAFD14
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: GetDC.USER32(00000000), ref: 00CAFF8C
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: CreateCompatibleDC.GDI32(00000000), ref: 00CAFF97
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 00CAFFAC
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: SelectObject.GDI32(00000000,00000000), ref: 00CAFFB8
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: GetWindowRect.USER32(?,?), ref: 00CAFFD1
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: GdipCreateFromHDC.GDIPLUS ref: 00CB0011
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: GdipDrawImagePointsI.GDIPLUS(?,00000000,?,00000003), ref: 00CB0035
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: SetWindowLongW.USER32(?,000000EC,?), ref: 00CB0048
                                                                                                                                                                                                          • Part of subcall function 00CAFF80: GetDC.USER32(00000000), ref: 00CB007A
                                                                                                                                                                                                        • SetTimer.USER32(?,00000064,00000096,00000000), ref: 00CB02A6
                                                                                                                                                                                                        • SetTimer.USER32(?,00000001,00001F40,00000000), ref: 00CB02B5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Create$GdipTimerWindow$CompatibleDrawFindFromImageLongObjectPointsRectResourceSectionSelect
                                                                                                                                                                                                        • String ID: PNG
                                                                                                                                                                                                        • API String ID: 1864590021-364855578
                                                                                                                                                                                                        • Opcode ID: 98377a7c50fdc6c845facc83eec0d88bfb9db465187c68831a903e55f0f97a63
                                                                                                                                                                                                        • Instruction ID: 063ced684d9a97f41d80967fede3937da7db6836799f81ec64ac09551015d0b6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 98377a7c50fdc6c845facc83eec0d88bfb9db465187c68831a903e55f0f97a63
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94E01A7678070036E124B6A5DC47F9B62999B95F04F01452AF7426A1C6C9E1A84686A0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E0EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InvalidateRect.USER32(00000020,00000000,00000001,6C8E12C7,?,?), ref: 6C8E0EC7
                                                                                                                                                                                                        • UpdateWindow.USER32(00000020), ref: 6C8E0ED1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InvalidateRectUpdateWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1236202516-3916222277
                                                                                                                                                                                                        • Opcode ID: 5f7633d477d707ec03b959aaebbb01c7c6694fc7e0b96d424dea8853f930d37f
                                                                                                                                                                                                        • Instruction ID: 2f1236b272f462f83d8a0fd725dfabc20d91a678cfda8772850070e94cc8ece2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5f7633d477d707ec03b959aaebbb01c7c6694fc7e0b96d424dea8853f930d37f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A6F039742187009BE370DB20C608B02BBF4AB4AB09F008D2CE986D6A80C7B2E480CB10
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8E0EF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InvalidateRect.USER32(00000020,00000000,00000001,6C8E12EA,?,?), ref: 6C8E0F17
                                                                                                                                                                                                        • UpdateWindow.USER32(00000020), ref: 6C8E0F21
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InvalidateRectUpdateWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1236202516-3916222277
                                                                                                                                                                                                        • Opcode ID: bd7b198205dd2c2fa81f581f6822ab093c3e10f918fd3a332fd16d1560803aee
                                                                                                                                                                                                        • Instruction ID: 1d5f2d7e5973d17aef01637ba653cc8122fa81a1cdd9dc7a2a0cf2b4842037dd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd7b198205dd2c2fa81f581f6822ab093c3e10f918fd3a332fd16d1560803aee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57F03975619B019BD320DB20CA08B02B7F4AB5AB18F108E18E5A6C6AD0C7B6E480CB10
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C8F0E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 6C8F0E24
                                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,weblogin,00000000), ref: 6C8F0E3B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$FindVisible
                                                                                                                                                                                                        • String ID: weblogin
                                                                                                                                                                                                        • API String ID: 744408688-858765054
                                                                                                                                                                                                        • Opcode ID: 168ff98a6225fb8d44c163658f76104fb595df5c125ba705861329b7d335cdd8
                                                                                                                                                                                                        • Instruction ID: 4e7c66eeba1a778a500a6ad767eab977fc0e8ff9f71bcafa4dfc6389e402319b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 168ff98a6225fb8d44c163658f76104fb595df5c125ba705861329b7d335cdd8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 99E017743947459BEB34AB328E08B56B6F6BB46F89F608C18E226C7E80D774E000CB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 6C936C74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C936C5B
                                                                                                                                                                                                          • Part of subcall function 6C90C50B: RaiseException.KERNEL32(?,?,?,6C921AA5,?,?,?,?,?,6C921AA5,6C95405C,6C95405C,6C921C91,.\QHNewSign.cpp,000001BF,00000000), ref: 6C90C54D
                                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 6C936C83
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • Access violation - no RTTI data!, xrefs: 6C936C7B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2141664981.000000006C891000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C890000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2141604242.000000006C890000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142167391.000000006C942000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142279575.000000006C960000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142323014.000000006C963000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142356949.000000006C964000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C968000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2142599889.000000006C97B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_6c890000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionException@8RaiseThrowstd::bad_exception::bad_exception
                                                                                                                                                                                                        • String ID: Access violation - no RTTI data!
                                                                                                                                                                                                        • API String ID: 1843230569-2158758863
                                                                                                                                                                                                        • Opcode ID: 65ce508d781e8e8a3b3238c1fdb652415ef27cdcb6111173d99e2c751836feb4
                                                                                                                                                                                                        • Instruction ID: 4241602012f12ea3dd5258d254e9fb39cc726745a0e6907cec66997f5cead5e2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 65ce508d781e8e8a3b3238c1fdb652415ef27cdcb6111173d99e2c751836feb4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00E012B6A005088FCF04DBA4C881ADD77B0AB59315F140859E502F7B50D734E9A5DF66
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00CB0AD9 Relevance: 5.1, APIs: 4, Instructions: 59memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetProcessHeap.KERNEL32(00000000,0000000D,?,00CA6FFE), ref: 00CB0A5A
                                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000000,?,00CA6FFE), ref: 00CB0A61
                                                                                                                                                                                                          • Part of subcall function 00CB0972: IsProcessorFeaturePresent.KERNEL32(0000000C,00CB0A48,?,00CA6FFE), ref: 00CB0974
                                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00CA6FFE), ref: 00CB0A83
                                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00CA6FFE), ref: 00CB0AB0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000013.00000002.2139362416.0000000000CA1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00CA0000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139157373.0000000000CA0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139496463.0000000000CC4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139554969.0000000000CCC000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000013.00000002.2139607919.0000000000CD8000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_ca0000_flashApp.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocHeapVirtual$FeatureFreePresentProcessProcessor
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4058086966-0
                                                                                                                                                                                                        • Opcode ID: c157cef880fd9d4a2cf243282e954f81935e81b5f6441a159c86930fe9a2e3e5
                                                                                                                                                                                                        • Instruction ID: 95fb8d8707dabfe3df4b7c992899ee4a4e1b09cb4ad5858674b1bafb6a5cb61e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c157cef880fd9d4a2cf243282e954f81935e81b5f6441a159c86930fe9a2e3e5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F201B531640312ABEB315768FC18FEF3669EB81792F354824F905D6190CB70CD00EBA0
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%